Website Security Checker

A combined diagnostic overview — SSL, security headers, HSTS, and mixed content — in one place. This is a diagnostic tool, not a penetration test: it performs no exploitation, brute forcing, or destructive checks of any kind.

What is a website security checker?

A website security checker gives you one overview of the protections a site shows to the outside world. This one combines three areas: the SSL certificate, how HTTPS is enforced, and which security headers are sent. It is a diagnostic overview, not a penetration test: it makes ordinary requests only and never tries to break in, guess passwords or exploit anything.

Use it as a quick first pass, then open the dedicated tools for any area that needs work.

How the website security check works

From the address you enter, the tool takes the hostname and inspects its certificate on the HTTPS port. It then requests the page itself, following redirects, and reviews the response. The results appear in three sections.

SSL / TLS

The overall certificate status, covering trust, hostname match and expiry, with the expiry date and days remaining.

HTTPS and transport

Whether the final page is served over HTTPS, whether an http:// address you entered redirects to HTTPS, and whether the HSTS header is present.

Security headers

Present, Missing or Issue for six headers: Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy. Mixed content has its own dedicated tool, linked from the results.

How to use the website security checker

Enter the site's address; include http:// if you want to test the redirect to HTTPS.
Press Check Security.
Read the summary, then each of the three sections.
Follow the links to the dedicated tools for detail and fixes.

Understanding the security results

A pass in every area means the visible basics are in place: a trusted, current certificate, HTTPS enforced and protective headers sent. That is a good sign, but it covers only what any visitor can see. It cannot check software versions, passwords, plugins, file permissions or server configuration behind the scenes. Treat it as one part of keeping a site secure, alongside updates, backups and strong logins.

What this tool deliberately does not do

It does not scan ports, send attack payloads, crawl hidden pages or test logins. Those activities need the owner's permission and specialist tools. Keeping the check non-intrusive means you can safely run it on any public website, including ones you are thinking of trusting with your data.

A simple website security routine

Keep the CMS, theme, plugins and server software up to date.
Use unique passwords and two-factor login on every admin account.
Keep regular backups stored away from the web server.
Remove unused plugins, user accounts and old test sites.
Run this check again after each change to hosting or settings.

None of these steps needs special tools, yet together they prevent most of the problems that affect small and medium websites.

Common uses

A quick security snapshot before launching a site.
Reviewing a supplier's website before sharing information with it.
Re-checking after a move to new hosting or a new CDN.
Giving a site owner a clear list of what to ask their web developer to fix.

Common problems and fixes

SSL shows a problem. Open the SSL Checker for the exact reason, such as a missing intermediate certificate, and fix it with your host.

HTTP does not redirect to HTTPS. Add a permanent 301 redirect in your server, CDN or hosting panel.

A header shows Issue. The header is present but set to a value that does not protect visitors. The Security Headers Checker shows the exact value and the reason.

Headers are missing. Add the low-risk ones first, then plan Content-Security-Policy carefully.

Related tools

SSL Checker gives full certificate detail.
Security Headers Checker shows the purpose and value of every header.
Mixed Content Checker lists insecure http:// files used by a secure page.
HSTS Checker reviews HTTPS enforcement settings.
Domain Risk Check lists wider technical risk signals for a domain.

Frequently asked questions

Is this website security checker a vulnerability scan?

No. It is a non-intrusive diagnostic that makes ordinary requests, like a visitor's browser. It checks the certificate, HTTPS enforcement and security headers. It does not scan ports, test for software vulnerabilities, guess passwords or attempt any attack, so it is safe to run on any public website.

What does the website security checker test?

Three areas: the SSL certificate, including trust, hostname match and expiry; HTTPS enforcement, meaning HTTPS on the final page, an HTTP to HTTPS redirect and the HSTS header; and six security headers. Mixed content is covered by the dedicated Mixed Content Checker, linked from the results.

If my site passes everything, is it secure?

It means the visible protections are in place, which is a good start. Security also depends on things no outside check can see, such as up-to-date software and plugins, strong unique passwords, two-factor login, careful file permissions and regular backups. Keep those in order too.

Why should I enter http:// at the start?

Entering an http:// address lets the tool test whether insecure requests are redirected to HTTPS. Without it, the check starts on HTTPS directly and the redirect test is skipped. Both approaches check the certificate, the final page and the security headers.

Can I check a website I do not own?

Yes. The tool only reads information that every visitor's browser receives, so checking any public site is fine. It is a useful way to judge whether an online shop or supplier takes basic security seriously before you share personal or payment information with it.

How often should I check my website's security?

Run it after any change to hosting, CDN, certificates or server settings, and at least monthly for important sites. Certificates renew and settings drift over time, and a regular check catches an expired certificate or a dropped header before visitors are affected.

What should I fix first?

Start with the certificate and HTTPS: an untrusted or expired certificate and a missing HTTP to HTTPS redirect affect every visitor. Then add HSTS and the low-risk headers, X-Content-Type-Options, X-Frame-Options and Referrer-Policy. Plan Content-Security-Policy last, testing it in report-only mode first.