HTTPS enabled
CheckedChecks whether the site can be reached over encrypted HTTPS instead of plain HTTP.
Why it mattersInstall and renew a trusted TLS certificate, then serve the whole site over HTTPS.
Security Tool
Free Website Security Checker
Enter a domain to check the security basics browsers can see from the outside: HTTPS, redirects, HSTS, CSP, clickjacking protection, referrer controls, MIME sniffing protection and exposed server headers.
No port scansNo exploitationHeader checks onlyFree Tool
Security scoreEnter a site to see the score.
--/100Run a check to get a baseline score and practical fixes.
What the checker will test
These lightweight external checks catch common missing browser protections before you spend time on a deeper review.
HTTP to HTTPS redirect
CheckedLooks for a clean redirect from the insecure HTTP version to the secure HTTPS version.
Why it mattersAdd a permanent redirect so every HTTP request lands on the matching HTTPS URL.
HSTS header
CheckedChecks whether browsers are told to keep using HTTPS on future visits.
Why it mattersEnable Strict-Transport-Security after confirming HTTPS works everywhere, including subdomains if needed.
Content-Security-Policy
CheckedLooks for a CSP header, which can reduce the impact of injected scripts and unsafe content.
Why it mattersStart with a report-only CSP, review what your site loads, then enforce a tight policy.
X-Content-Type-Options
CheckedChecks for nosniff protection so browsers do not guess unsafe file types.
Why it mattersAdd X-Content-Type-Options: nosniff to reduce browser MIME-type guessing.
Referrer-Policy
CheckedChecks whether the site limits how much URL information is sent to other websites.
Why it mattersUse a sensible default such as strict-origin-when-cross-origin unless the site needs something stricter.
Frame protection
CheckedChecks for X-Frame-Options or CSP frame-ancestors to help prevent clickjacking.
Why it mattersUse CSP frame-ancestors or X-Frame-Options to control which sites can embed your pages.
Server header exposure
CheckedChecks whether the response reveals avoidable server platform information.
Why it mattersRemove detailed server/version headers where your hosting stack allows it.
Important disclaimer
This is not a full penetration test or vulnerability scan. It does not attempt exploitation, aggressive probing, port scanning, credential testing or application logic testing. It only reviews a small set of public HTTP and HTTPS response signals.
What does this website security checker test?
The checker looks for HTTPS, an HTTP to HTTPS redirect where it can be tested, HSTS, Content-Security-Policy, X-Content-Type-Options, Referrer-Policy, clickjacking protection through X-Frame-Options or CSP frame-ancestors, and whether the Server header is exposed.
Why HTTP security headers matter
Security headers tell browsers how to handle your website. Good headers can reduce the impact of content injection, MIME sniffing, clickjacking, referrer leakage and accidental insecure HTTP use.
Common website security weaknesses
- Missing or inconsistent HTTPS redirects
- No HSTS policy after HTTPS is enabled
- Weak or absent Content-Security-Policy rules
- Pages that can be embedded by another website
- Verbose technology headers that reveal avoidable platform details
- Outdated plugins, dependencies or server software that need a deeper review
When to book a penetration test
Book a penetration test when you are launching a new website, changing authentication or payment flows, handling sensitive data, preparing for compliance, or needing confidence beyond automated header checks.
Need a proper security review? Ask SharkyWeb about penetration testing.