Free tool

Free Website Security Check

Enter your website and we'll run a few passive checks: SSL, security headers, HTTPS redirect and privacy policy. No login, nothing intrusive.

We only read publicly available information. We never log in, scan ports, or attempt to exploit anything. Results may vary for sites behind a firewall or bot protection (e.g. Cloudflare). This is a quick teaser, not a definitive scan.

What this checks

Whether your homepage answers over HTTPS with a certificate the scanner accepts.
Whether a plain http:// request is redirected straight to an https:// address.
Whether at least three of four core security headers are present: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options and X-Content-Type-Options.
Whether the homepage links to or mentions a privacy policy.

Why it matters

This is the quickest way to see whether the basics are in place before you look at anything deeper. A school, clinic or shop whose site still loads over plain HTTP exposes form submissions to anyone on the same network, including public Wi-Fi. A missing privacy policy matters because the Cyber and Data Protection Act of 2021 expects people to be told how their information is used. The check is passive: it reads what any browser would see and changes nothing on your server.

How to read the result

The score is simply the share of the four checks that passed, so 75% means exactly one check failed. Read the failed line, not just the number.
A failed HTTPS line usually means the certificate is missing, expired or issued for a different name. Run the SSL Certificate Checker to see which.
The headers line lists which of the four were found and which are missing, so you know exactly what to add.
A pass on privacy only means a link or the words privacy policy appear on the homepage. It does not judge whether the policy itself is adequate.

How to fix what it finds

Install a free certificate from Let's Encrypt or switch on AutoSSL in cPanel, then confirm it covers both the bare domain and the www name.
Add a permanent 301 redirect from HTTP to HTTPS in your server or hosting settings, or in .htaccess on Apache hosting.
Add the missing response headers at the web server, CDN or framework level rather than in page markup, so every response carries them.
Publish a privacy notice that says what you collect, why, how long you keep it and who to contact, and link it from the footer of every page.

Want it fixed for you, or tested properly? See what a test would cost or book a free 30 minute call.

Questions people ask

Is it safe to run a security check on my website?

Yes. The check makes the same kind of requests a normal browser makes when someone visits your homepage. It does not log in, submit forms or probe for vulnerabilities, so it cannot break anything.

Why does my site fail even though it shows a padlock?

The padlock only covers the certificate. You can have a valid certificate and still fail on the HTTP redirect, missing headers or a missing privacy policy, which are separate checks.

Is a 100% score the same as being secure?

No. Four passive checks cover the visible basics only. Outdated plugins, weak admin passwords and flaws in your forms or logins need a proper assessment, such as a Website Security Audit, to find.