How safe is your website for the people who visit it?
Type your address. We read the security headers your server sends, the same ones browsers look at, and grade them from A to F with what is missing and how to fix it.
- No sign-up, full result
- 6 weighted checks, grade A–F
- A fix for every finding
Public pages only. We keep the address and the result, never the page content.
Six headers browsers ask for, and how much each one weighs
Security headers are sent by the server with every page. They change nothing visible, but they tell the browser what to forbid. They take a few lines to set and protect every visitor.
Transport
Nobody can sit between you and the visitor.
- Strict-Transport-Security (25 points)
- At least 6 months
- includeSubDomains and preload
Content isolation
Only what you put on the page runs on it.
- Content-Security-Policy (25)
- frame-ancestors or X-Frame-Options (15)
- X-Content-Type-Options (10)
Visitor privacy
URLs do not leak and permissions are not requested without reason.
- Referrer-Policy (15)
- Permissions-Policy (10)
- Server versions: a note, not graded
Before you press Check
What does the grade mean?
Each header carries a weight according to how much it protects: full when set correctly, half when present but weak, zero when missing. A is 90 points or more, F is below 30. Most sites we check score D or worse, not because anything was hacked, but because nobody ever configured the server.
Does an F mean my site has been breached?
No. It means the server does not give the browser the instructions that would block an attack if one happened. Like a house without a lock: nobody has walked in yet, but nothing stops them.
How hard are these to fix?
Five of the six are one line each in nginx, Apache or your hosting panel, with no change to the page. Content-Security-Policy needs testing, because it can block scripts you rely on (Google Analytics, Maps, chat). That is why we show each header's value: hand it as it is to whoever manages the server.
Do you check anything besides headers?
Not here. This tool does one thing well. For SEO, speed and visibility to AI assistants there is the free website check, which covers 30 points.Free website check
Want us to set them up?
The websites we build get an A from day one. If yours scored low, send us the result and we will tell you what your server needs.