Free website security check
Type in your web address and we'll grade how well your site is protected, in plain English. No sign-up, nothing stored, results in about 20 seconds.
Works on any public website. Powered by the MDN HTTP Observatory, a free scanner run by Mozilla.
What this check looks at
Every time someone visits your website, their browser asks your server a set of questions and your server answers with a list of settings called headers. Those settings tell the browser how carefully to treat your pages. If they're missing, your site is easier to tamper with, easier to impersonate, and more likely to be flagged by security tools your customers use.
- Is the secure version enforced? Visitors should always land on https://, and browsers should remember that.
- Can your pages be embedded by other sites? If so, a criminal can wrap your site in theirs to trick people into clicking.
- Which scripts are allowed to run? A Content Security Policy stops injected code from stealing form data.
- Are cookies protected? Login cookies should never be readable by scripts or sent over plain HTTP.
What a poor grade means
A D or F doesn't mean you've been hacked. It means the standard protections most browsers expect aren't switched on. Nearly all of them are configuration changes on your web host or Cloudflare, not a rebuild. Most sites we see go from F to A in an afternoon.
What it doesn't check
This scans how your site is served, not what's inside it. It won't find out-of-date plugins, weak admin passwords, exposed backups or problems with the systems behind the site. Those are covered in our security review, which also looks at your email, accounts, devices and backups.
Common questions
Is this website security checker really free?
Yes. It uses Mozilla's public HTTP Observatory service and runs in your browser. We don't store the address you enter or the result.
My site got an F. Have I been hacked?
Not necessarily. An F means the protective settings are missing, which makes an attack easier, not that one has happened. The fixes are usually quick.
Can you fix the problems the check finds?
Yes. Send us the address through the contact form and we'll come back with what needs changing and what it costs. For most small business sites it's a short, fixed-price job.
Does the check work on WordPress, Wix or Squarespace sites?
Yes, it works on any public website, whatever it's built with. Some hosted platforms limit which settings you can change, and we'll tell you if that's the case.