Free tool
What does your website reveal to attackers?
A free, read-only check of your site’s public security posture: headers, encryption, cookies, and email authentication, explained in plain English and mapped to the OWASP Top 10:2025.
No attack trafficResults in secondsSave the report as PDF
Free website security check
Enter a domain you own or are authorized to check. This is a read-only review of what your site already shows the public. It sends no attack traffic.
Scope
What this check covers, and what it doesn’t
Most real breaches come from issues no passive scan can see. Here is exactly where this tool’s view ends.
Covered
- Security headers: HSTS, Content-Security-Policy, clickjacking, MIME sniffing, referrer and permissions policies
- TLS certificate validity and protocol version
- Cookie security flags
- Software version disclosure
- Email authentication: SPF and DMARC
- security.txt disclosure contact
Not covered
- Broken access control and privilege escalation
- Injection and cross-site scripting testing
- Passwords, login protection, and two-factor authentication
- Outdated plugins, themes, and dependencies
- Business logic flaws
assessmentContact