Website Security Check
Enter your website address for a graded check of HTTPS and redirects, security headers, cookie flags, mixed content, version disclosure, security.txt, CAA, DNSSEC and DMARC, with a plain-English fix for each item.
Loads the home page, security.txt and the www or non-www twin of the address from our edge, plus a few DNS lookups. Nothing is scanned for vulnerabilities and no login is attempted; this is the same information any browser receives. Takes a few seconds.
What this check looks at
Everything here is visible to any browser that loads your home page: whether plain http:// redirects to https://, whether HSTS tells browsers to stay on HTTPS, which security headers are sent, whether cookies carry the Secure and HttpOnly flags, whether the page pulls scripts or images over plain HTTP, and whether headers or meta tags announce the exact software versions in use. It also looks for a security.txt file, a CAA record, DNSSEC and a DMARC record for the matching email domain.
It is not a vulnerability scan. It does not test logins, probe for plugins, submit forms or look for known exploits, and it loads nothing beyond the home page and two well-known paths. Think of it as the ten-minute check a security reviewer does before anything else, turned into a tool you can run yourself.
How the grade works
Each check is a pass, something to improve, something to fix, or optional. Items marked Fix cost 20 points and are things like serving the site over plain HTTP or loading scripts insecurely. Items marked Improve cost 7 points and are mostly missing headers. Optional items such as CAA, DNSSEC and security.txt cost nothing, because many well-run sites do without them. A is 90 or above, B 75, C 60, D 40, anything lower is an F.
A C or D grade on an otherwise healthy site is common and usually means the headers were never set, not that the site has been compromised. Most of them are a few lines in the web server, hosting control panel or Cloudflare dashboard, and the "What to do" line under each item says which.
Which items matter most
HTTPS with a redirect from HTTP, and HSTS once that works. Without these, anyone on the same Wi-Fi as a visitor can read or alter what they see. Next, a Content Security Policy and clickjacking protection, which limit the damage if a plugin flaw or a compromised third-party script tries to run code in your visitors’ browsers. Version disclosure is worth closing because automated attacks search for exact versions with known holes. The DMARC item is about email rather than the website, but it is the same domain and the same reputation, so it is included.
Website Security Check: common questions
Is this a vulnerability scan or penetration test?
No. It reads the home page and a handful of well-known paths exactly as a browser would and reports what the site sends back. It does not probe for weaknesses, test logins or submit anything. A penetration test is a manual, authorised exercise; this is the quick hygiene check that comes before it.
Why does my site get a C when it has never been hacked?
The grade measures protections, not incidents. Missing headers do not mean the site is compromised; they mean the browser has less help if something else goes wrong. Most of the items are quick to add and the grade will move as soon as they are in place.
My site is on WordPress, Wix, Squarespace or Shopify. Can I change these?
Partly. Hosted builders such as Wix, Squarespace and Shopify control the headers themselves, so some items cannot be changed and are set well enough by the platform. On WordPress you can set headers in the web server configuration, with a security plugin, or at Cloudflare if the site sits behind it. Cloudflare in particular can add HSTS, redirects and most headers without touching the site.
Why did the check say the site blocked it?
Some firewalls and bot filters answer automated requests with a 403 or a challenge page. The tool still reports the headers it saw, but they may belong to the block page. Compare with your browser’s developer tools (Network tab, Headers) or allow the user agent TheLogic-SiteCheck for a moment.
Can I check a site I do not own?
The tool only reads what the site publishes to every visitor, so it is harmless to run on any public site. Fixing anything it finds is of course up to the owner. If you are a charity or a small business in Scotland and want help with the list, get in touch.
Do you keep the results?
Results are cached at our edge for ten minutes so repeated checks of the same address do not hit the site again. We do not store the address you entered or the results beyond that.
More free tools
Want someone to fix the list?
Most of these items take minutes to put right on a well-managed site and years to get round to on an unmanaged one. Our cyber security service covers websites, Microsoft 365, email authentication and Cyber Essentials, so the fixes get done and stay done.