Check your website's public configuration
HTTPS, security headers and cookies of your home page. Free, no email needed.
Scope, terms of use and privacy
The result is a limited technical observation of the moment and the responses shown. It is not an audit, a penetration test or a certification. It does not show that the website is secure, that it has been compromised or that it complies with the GDPR or any other law or standard. Your provider should assess each change and check that it does not break the service. I manage this website or have permission to check it, and I accept the terms of use. We process the domain during the query and use short-lived pseudonymous hashes to limit abuse. The result is not kept when you reload; it is not queried again automatically.
How we run the check
A low-intensity public reading: your home page (with and without HTTPS), its encrypted connection and, where relevant, the security.txt file, where a website says who to contact about a security flaw. We do not run JavaScript or load images from the website. We do not test for vulnerabilities, forms or logins, and we only use the usual web ports.
At most 40 network operations and 10 seconds per check. Limits, blocks or incomplete responses are shown as pending coverage, never as proof of security.
What we check
The findings are grouped into four blocks. Each one says what we observed, why it matters and what to ask whoever maintains your website.
- Connection. Whether the home page responds over HTTPS with a valid, in-date certificate for your domain, whether it expires soon, whether the server accepts old versions of connection encryption (TLS), whether the HTTP version redirects to HTTPS and whether it publishes HSTS.
- Browser protections. The security headers that limit what the browser allows on your page: Content-Security-Policy, protection against framing (frame-ancestors or X-Frame-Options), X-Content-Type-Options, Referrer-Policy and Permissions-Policy.
- Cookies observed. The Secure, HttpOnly and SameSite attributes and the prefixes of the cookies the home page sends in its headers, without showing their values.
- Public information. Whether you publish a security.txt file so that people can report vulnerabilities to you, and whether the home page headers or code reveal the software and its version.
What to do with the result
Start with the priority actions, at most three: they are ordered by importance and addressed to your web provider or IT team. If something shows as «No data», do not treat it as good or bad: run the check again later or ask your provider to review it. After changing the configuration, check the home page again.
Who it is for
For anyone with a company website who wants to know, without technical knowledge, what to review with their provider or IT team. The result can be copied as instructions for IT. It does not replace an audit or a penetration test: it does not look for vulnerabilities or review other pages of your site.
Frequently asked questions
What are HTTP security headers?
Instructions that the server sends to the browser with each page to limit what it can do with it: Content-Security-Policy (where it can load scripts and other resources from), Strict-Transport-Security (always use HTTPS), framing protection, X-Content-Type-Options, Referrer-Policy and Permissions-Policy.
What is wrong with misconfigured security headers?
If they are missing or wrong, the browser allows things that make attacks easier: another site loading yours in a frame to trick its users, injected code running, or the connection ending up on unencrypted HTTP. A header that is too strict can also break parts of the site: test each change before publishing it.
How do I check whether my website is secure?
This check looks at one part: HTTPS and the certificate, security headers, the cookies of the home page and what it reveals publicly. To know whether a website is secure you also need to review its software, its forms and its access points, which is what an audit or a penetration test does.
Is it an audit, a vulnerability scanner or a penetration test?
No. It is a limited reading of the home page and the standard paths shown, at a specific moment. It does not look for known vulnerabilities in your software, like a scanner, or try to exploit them, like a penetration test.
Which cookies can you see?
Only those sent in the Set-Cookie headers of the responses we read, including the redirects observed. We do not show their values or see the ones that would appear when the page runs.
Do you store the domain?
The check does not store the domain or the result in our database; we only use them during the query, with short-lived hashes to limit abuse. If you request the report, we store the domain and the result of a new check, linked to your email address, to send it to you and give you access to it.
Why does it say No data?
That check could not be read or interpreted with enough certainty. On its own it does not mean that the website is failing.
What does green mean?
The main checks of this home page did not show issues. Also review the secondary improvements and the coverage limits. It does not cover the rest of the site or show legal compliance.