Is your website's security configuration solid?
Run a free check of your website's security configuration. See exactly what's missing — and how to fix it.
Most website security problems aren't exotic — they're missing configuration: no HTTPS redirect, no security headers, cookies without the right flags, email that's easy to spoof. Our scanner checks your site's publicly visible security configuration against established best practices, so you can see exactly what's missing and how to fix it. This is a configuration and best-practices check, not a penetration test.
How it works
We check your live configuration
We fetch your homepage, TLS certificate, and DNS records — no login or installation needed.
24 security checks run
We check HTTPS, headers, cookies, email/DNS security, and server configuration against best practices.
Score + action plan
Each finding is graded by severity and comes with a specific configuration fix.
What we check
Secure Connection
- ✓HTTPS not enabled
- ✓SSL certificate invalid or expiring soon
- ✓HTTP does not redirect to HTTPS
- ✓Mixed content detected (HTTP resources on an HTTPS page)
Security Headers
- ✓Missing Strict-Transport-Security (HSTS) header
- ✓Missing Content-Security-Policy header
- ✓Missing X-Frame-Options header
- ✓Missing X-Content-Type-Options header
- ✓Missing Referrer-Policy header
- ✓Missing Permissions-Policy header
- ✓Missing Cross-Origin isolation headers
Cookie Security
- ✓Cookies missing the Secure flag
- ✓Cookies missing the HttpOnly flag
- ✓Cookies missing the SameSite flag
Email & DNS Security
- ✓Missing SPF record
- ✓Missing DMARC record
- ✓DKIM could not be verified
- ✓DNSSEC not detected
- ✓Missing CAA record
- ✓Missing IPv6 (AAAA) record
Server Configuration
- ✓Server header exposes version info
- ✓X-Powered-By header exposes technology
- ✓Missing security.txt file
- ✓Directory listing detected
Security best practices — not a penetration test
This scan checks your website's publicly visible security configuration — HTTPS, headers, cookies, and DNS records — against widely recognized best practices (OWASP, RFC standards). It's a configuration and best-practices check, not a vulnerability scan or penetration test.
What is a website security configuration check?
A configuration check looks at how your website is set up from the outside — the same information any visitor's browser or any automated tool can see. It doesn't attempt to break in, guess passwords, or exploit anything. It simply verifies that well-known best practices (HTTPS, security headers, cookie flags, email authentication records) are actually in place.
- •Checks HTTPS enforcement, certificate validity, and security headers
- •Reviews cookie flags (Secure, HttpOnly, SameSite) for privacy and session safety
- •Verifies email authentication records (SPF, DMARC, DKIM) that prevent spoofing
- •Never attempts to exploit, break into, or disrupt your website
Why do security headers matter?
Security headers are instructions your server sends to every visitor's browser, telling it how to behave defensively — for example, refusing to load your site inside another site's frame, or blocking browsers from guessing a file's content type. Most frameworks don't set them by default, so it's an easy thing to miss even on an otherwise well-built site.
- •Headers like HSTS and CSP are recommended by OWASP and major browser vendors
- •Missing headers don't mean a site has been compromised — they mean an extra layer of defense is absent
- •Most headers can be added with a few lines of server or CDN configuration
- •We show the exact configuration snippet for your likely server (nginx, Apache, Cloudflare)
What do SPF, DKIM, and DMARC actually protect against?
These three DNS records work together to make it harder for someone to send email that looks like it came from your domain — a common tactic in phishing. Without them, your domain is an easier target for impersonation, which can affect deliverability and reputation even if you never notice an attack directly.
- •SPF lists which mail servers are allowed to send email for your domain
- •DKIM lets receiving servers verify a message wasn't altered in transit
- •DMARC tells receiving servers what to do when SPF or DKIM checks fail
- •DKIM has no single discoverable DNS location, so our check for it is best-effort
Frequently asked questions
Related compliance tools
Website Compliance Checklist
The most common issues across GDPR, AI Act, and accessibility in one checklist.
GDPR Compliance Scan
Run a free scan covering cookies, trackers, consent, and privacy policy.
WCAG Accessibility Checker
Check your website against WCAG 2.1 AA success criteria for free.
AI Act Compliance Check
Assess your organisation's readiness for the EU AI Act.