WHOISWebsite Health Checker
A combined, non-intrusive health check — HTTPS, security headers, response time and status — in one overall score.
What is a website health checker?
A website health checker gives a quick, overall view of how well a site is set up, as a score out of 100. This one combines seven non-intrusive checks covering HTTPS, the status code, response speed, three security headers and redirects. Each check is shown as Pass or Fail with the reason, and any failures are turned into a list of recommendations.
Nothing is scanned or attacked. The tool makes one ordinary request, like a visitor would, and judges what it sees.
How the website health score works
Each check carries a fixed number of points. Passing checks add their points to the score, so the maximum is 100.
| Check | Points |
|---|---|
| The final address uses HTTPS | 25 |
| Status code is healthy (200 to 399) | 20 |
| Responds in under two seconds | 15 |
| Sends Strict-Transport-Security | 15 |
| Sends X-Content-Type-Options | 10 |
| Has clickjacking protection (X-Frame-Options or Content-Security-Policy) | 10 |
| Reaches its destination in one redirect or fewer | 5 |
The score circle is green from 80, amber from 50 and red below 50.
How to use the website health checker
- Enter the site's address, for example
example.com. - Press Check Health.
- Read the score, then each check and its reason.
- Work through the recommendations, starting with the checks worth the most points.
Understanding your website health results
A high score means the basics are in place: the site loads securely, responds quickly and sends key protective headers. It does not measure content, search rankings, accessibility or the full page load in a browser. A lower score usually comes from missing security headers, which are often quick to add.
The speed check measures one request from our server, so a result near two seconds may pass on one run and fail on the next. Check a few times before acting on it.
Because the score uses fixed points, two sites with the same score can have quite different gaps. Always read the individual checks, not just the number.
Why these checks were chosen
Each check reflects something visitors and browsers rely on. HTTPS protects data on its way between the visitor and the site. A healthy status code shows the page actually works. Speed matters because visitors leave slow pages. The three headers guard against common browser-side attacks: HSTS stops downgrades to insecure HTTP, X-Content-Type-Options stops browsers guessing file types, and frame protection blocks clickjacking. A short redirect path keeps the first visit fast.
Improving your score step by step
- Fix HTTPS and status code problems first; together they are worth 45 points.
- Add the three security headers, worth 35 points in total.
- Speed up the response with caching or a CDN.
- Reduce redirects to a single hop.
Common uses
- A quick health check after launching or moving a website.
- Showing a client which simple fixes would improve their site.
- Confirming that new security headers are live.
- Re-checking a site after hosting, CDN or plugin changes.
- Comparing a staging site with the live site before switching over.
Common problems and fixes
HTTPS fails. The site does not end on an https:// address. Install a certificate and redirect all HTTP traffic to HTTPS.
The status check fails. The page returned an error code such as 404 or 500. Check the address you entered and the server's error logs.
Security headers fail. Add Strict-Transport-Security, X-Content-Type-Options and X-Frame-Options or a Content-Security-Policy at your server, CDN or host.
The speed check fails. Turn on page caching or use a CDN, and test again at a quieter time.
The redirect check fails. Merge separate HTTPS and www redirects into one.
Related tools
- Security Headers Checker explains each header in more depth.
- Website Response Time shows where time is spent.
- Redirect Checker traces every redirect hop.
- Domain Health Check scores DNS, SSL and email alongside the website.
Frequently asked questions
What does the website health checker test?
It runs seven checks: whether the final address uses HTTPS, whether the status code is between 200 and 399, whether the response arrives in under two seconds, three security headers and whether the site reaches its final address in one redirect or fewer. Each passed check adds its points to a score out of 100.
What is a good website health score?
A score of 80 or more, shown in green, means the basics are in place. Between 50 and 79, shown in amber, there is room for improvement, usually missing security headers. Below 50, shown in red, important checks such as HTTPS or a healthy status code have failed and should be fixed first.
Why does my site fail the speed check?
The measured response took two seconds or longer from our server. Slow hosting, no page caching, heavy server-side code or long redirect chains are the usual causes. Results vary between runs, so test a few times. If it keeps failing, see the Website Response Time tool for the breakdown.
Is this website health check safe to run on any site?
Yes. It makes one normal request, the same kind a browser makes when someone visits, and reads the response. It does not scan ports, test for vulnerabilities or send unusual traffic. That is why it is described as non-intrusive, and why it is safe to check any public website, including ones you do not own.
Does the website health score affect SEO?
The score itself is not used by search engines. Several of the checked items do matter for visitors and search, though: HTTPS, healthy status codes, quick responses and short redirect chains. Security headers mainly protect visitors and have no direct effect on rankings.
How is this different from the Domain Health Check?
This tool focuses on the website: HTTPS, status, speed, security headers and redirects. The Domain Health Check looks at the whole domain, including registration, expiry, DNS, DNSSEC, nameservers, SSL and email records. Use both together for a complete picture of a site and the domain behind it.
Why does a CSP count as clickjacking protection?
Clickjacking means loading your page invisibly inside another site to trick people into clicking. X-Frame-Options blocks this, and so does the frame-ancestors setting of Content-Security-Policy, which is the modern way to control framing. The check passes if either header is sent.