HTTPS and certificate
Is the site encrypted, with a valid certificate that matches your domain and is not about to expire?
Test the security
of your website.
A score out of 100 in seconds, then a detailed report with the fixes to apply. Free and risk-free for your website.
Free tool
Is your website really secure?
Paste your website address: you get your security score in seconds, then the full report by email if you want it.
- Passive scan, no risk for your website
- HTTPS, certificate, security headers, email
- Concrete recommendations, no jargon
Result in under 15 seconds.
-
What I check
Six signals
Six signals
that don't lie.
Security headers
HSTS, CSP, clickjacking and MIME sniffing protection: the safeguards the browser enforces for you.
Exposed information
Does your server announce its version or stack? Those are valuable hints for an attacker.
Email protection
SPF and DMARC stop scammers from sending emails that pretend to come from your company.
Security contact
A security.txt file tells researchers how to report a flaw to you instead of publishing it.
Response time
A slow site drives visitors away and can reveal a misconfigured server.
Need to go further?
The full audit tests your application the way an attacker would: OWASP flaws, access control, authentication, vulnerable dependencies. Prioritised report and help with the fixes.
FAQ
Frequently asked
Frequently asked
questions.
Can the scan damage my website?
No. It is fully passive: it only reads what your site shows to any visitor, with no intrusion attempt.
Can I scan a website I don't own?
The instant score only reads public information. An in-depth audit with penetration testing requires the owner's written permission.
What does the emailed report contain?
Each item checked, its risk level and the exact fix to apply on your server or application.
Does the score prove my site is secure?
No. It measures the visible configuration. Flaws in the code (injections, access control) need a full audit, which I can carry out.