Free website security scan for SSL, headers and exposed files
Run a website security health check on the configuration visitors and browsers rely on, from your SSL certificate to HTTP security headers and exposed files. Fixes include copy-paste Nginx and Apache config.
What it checks
Everything the website security scan looks at
SSL/TLS certificate
Checks the certificate is valid, shows the issuer and warns you how many days remain before it expires.
HTTPS enforcement
Confirms that plain HTTP requests are redirected to HTTPS so visitors are never left on an insecure connection.
Strict-Transport-Security (HSTS)
Checks HSTS is set with a suitable max-age so browsers always use HTTPS for your domain.
Content-Security-Policy and frame protection
Looks for CSP and X-Frame-Options or frame-ancestors, which help limit cross-site scripting and clickjacking.
Other security headers
Covers X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP and CORP, with config to add any that are missing.
Cookie flags
Checks cookies for the Secure, HttpOnly and SameSite attributes that protect sessions from theft and misuse.
Mixed content
Finds resources loaded over HTTP on an HTTPS page, which browsers may block or flag as insecure.
Version disclosure
Flags X-Powered-By headers that reveal software versions and make targeted attacks easier.
Exposed .env and .git files and security.txt
Probes for publicly reachable configuration and repository files, and checks for a security.txt contact file.
How it works
Three steps, about a minute.
-
1
Enter your URL
Paste your homepage or any public page on your site.
-
2
We inspect your configuration
We check your certificate, response headers, cookies and common exposed file paths without changing anything.
-
3
Copy the fixes
Missing headers come with ready-to-paste Nginx and Apache configuration.
What a website security scan covers
A website security scan of this kind looks at how your site is configured from the outside, the same view any visitor or attacker has. It checks that your SSL certificate is valid and not close to expiry, that HTTP traffic is redirected to HTTPS and that browsers are instructed to stay on HTTPS through HSTS. It then reviews the HTTP security headers that limit cross-site scripting, clickjacking and data leaking through referrers, and inspects cookies for the flags that protect login sessions. Finally, it probes for common mistakes such as publicly accessible .env and .git files. It is a configuration check rather than a malware scan, so it will not tell you whether your site has already been compromised.
How to fix security header warnings
Most security header issues can be fixed in your web server or CDN configuration without touching your application code. For each missing header, the report provides a snippet for Nginx and Apache that you can adapt and add. Start with HSTS, X-Content-Type-Options and Referrer-Policy, which rarely cause side effects. Content-Security-Policy needs more care, because a strict policy can block legitimate scripts; begin in report-only mode, review what would be blocked, then enforce. If the scan finds an exposed .env or .git file, treat it as urgent: block access immediately, then rotate any passwords, API keys or tokens the file contained, as you should assume they have been seen.
Why it matters
Never miss a certificate expiry
See exactly how many days your SSL certificate has left, which matters more as certificate lifetimes get shorter.
Fixes you can paste in
Server config snippets for Nginx and Apache turn a list of warnings into a ten-minute job.
Catch serious leaks
An exposed .env or .git folder can reveal passwords and source code; the scan checks for both.
Who it is for
Small business owners
Get a clear yes or no on whether the basics are in place, and something specific to hand to your host or developer.
Agencies
Add a security section to client audits and catch configuration gaps before a client notices them.
Developers and sysadmins
Verify headers, cookie flags and redirects after deployments or server changes.
Try the free tools
Learn more
-
Website Security Threats 2026: A UK Small Business GuideWebsite Security · 9 min read
-
TLS 1.3 Explained: What Website Owners Need to KnowWebsite Security · 9 min read
-
HTTP Security Headers: A Copy-Paste Guide for Nginx and ApacheWebsite Security · 8 min read
-
Content Security Policy for Beginners: Roll Out CSP SafelyWebsite Security · 3 min read
-
Exposed .env and .git Files: How They Leak and How to Block ThemWebsite Security · 8 min read
-
TLS Certificate Lifetimes Are Shrinking to 47 Days: The ScheduleWebsite Security · 8 min read
Yes. A single scan needs no signup, and the free plan includes 5 scans a day. Security makes up 20% of your overall A-F grade.
It is a quick outside-in review of the settings that protect visitors: a valid SSL certificate, HTTP redirected to HTTPS, security headers such as HSTS and Content-Security-Policy, safe cookie flags and no public .env or .git files. Run one after any server, host or CDN change, and at least every few months.
No. The scan checks your security configuration, such as certificates, headers, cookies and exposed files. It does not scan for malware or confirm whether a site has been hacked.
Yes. It makes ordinary web requests, similar to a browser, and requests a small number of well-known file paths. It does not attempt to log in or exploit anything.
Most headers are safe to add. Content-Security-Policy is the exception, so test it in report-only mode first and adjust the policy before enforcing it.
Free website audit
See how your site scores, free
Speed, SEO, DNS, email (SPF/DKIM/DMARC) and security in one scan, with a prioritised fix list.