Website security check: how well does it protect your visitors?
Type your address. We read the security headers your server sends, the same ones browsers look at, and grade them from A to F with what is missing and why it matters.
- No sign-up, full result
- 8 checks, grade A–F
- We also look at the page Google sees
Public pages only, plain visits like any browser's: no login attempts, no attack. We keep the address and the result, never the page content.
What security headers are
Every time a page opens, the server sends instructions to the browser along with it: the HTTP headers. Some of them are about security. They tell the browser to connect only over HTTPS, not to let other sites put your page in a frame and not to run scripts from unknown sources.
The tool checks six of these headers and gives you a grade from A to F, with a plain-language explanation of each finding.
How it works
- 1
You enter the address
Of any public page.
- 2
We read the server's response
Only the headers. We don't attempt any attack and we don't touch the page.
- 3
We score each header
Full points when it is set correctly, half when it is weak, zero when it is missing.
- 4
You get a grade and an explanation
A grade from A to F and what each header is missing, in plain words, so you know what to ask of whoever runs your server, or of us.
Why check your website's security
They protect your visitors
They shut known attacks such as clickjacking and connection hijacking, for every visitor, without changing anything on the page.
Most sites don't have them
Most Greek websites we check get a D or worse, simply because nobody ever configured the server.
The fix is cheap
Five of the six are one line each in the server or hosting settings.
Six headers browsers ask for, and how much each one weighs
Security headers are sent by the server with every page. They change nothing visible, but they tell the browser what to forbid. They take a few lines to set and protect every visitor.
Transport
Nobody can sit between you and the visitor.
- Strict-Transport-Security (25 points)
- At least 6 months
- includeSubDomains and preload
Content isolation
Only what you put on the page runs on it.
- Content-Security-Policy (25)
- frame-ancestors or X-Frame-Options (15)
- X-Content-Type-Options (10)
Visitor privacy
URLs do not leak and permissions are not requested without reason.
- Referrer-Policy (15)
- Permissions-Policy (10)
- Server versions: a note, not graded
Before you press Check
What does the grade mean?
Each header carries a weight according to how much it protects: full when set correctly, half when present but weak, zero when missing. A is 90 points or more, F is below 30. Most sites we check score D or worse, not because anything was hacked, but because nobody ever configured the server.
Does an F mean my site has been breached?
No. It means the server does not give the browser the instructions that would block an attack if one happened. Like a house without a lock: nobody has walked in yet, but nothing stops them.
How hard are these to fix?
Five of the six are one line each in nginx, Apache or your hosting panel, with no change to the page. Content-Security-Policy needs testing, because it can block scripts you rely on (Google Analytics, Maps, chat). That is why we show each header's value: hand it as it is to whoever manages the server.
Do you check anything besides headers?
Not here. This tool does one thing well. For SEO, speed and visibility to AI assistants there is the free website check, which covers 30 points.Free website check
Want us to set them up?
The websites we build get an A from day one. If yours scored low, send us the result and we will tell you what your server needs.