Is your website safe?
Enter your address and within seconds you will see whether the connection is properly encrypted, which protective settings are missing and whether anything is publicly reachable that should not be. No sign-up, and nobody calls you afterwards.
Quick check
- Encryption & certificate
- Protective headers & cookies
- Publicly visible files
Free · no sign-up · result in a few seconds
In-depth test
- Active, non-exploiting checks
- Open interfaces, methods, CORS
- XSS and error indicators
Only for your own website – after a quick proof via meta tag or file.
What gets checked
Encryption
Whether the connection is encrypted throughout, HTTP redirects to HTTPS and the certificate is valid and not expired.
Protective settings
The headers that protect visitors from injected code, click traps and intercepted connections — HSTS, CSP and more.
Software disclosed
Whether your site publicly states its server and system version and whether that version counts as outdated.
Exposed files
Whether files are reachable that should never be public — such as the configuration (.env) or the source code (.git).
Cookies
Whether cookies that are set carry the usual protection flags (Secure, HttpOnly, SameSite).
For your own website
The check only looks at what any visitor already sees from the outside and runs no attacks — it is meant as a self-assessment for site owners, not as a scanner for third-party sites. Please only check sites you run or are authorised to check.
What the check cannot do
It is a look from the outside, not a full penetration test. It does not log into your site, does not test your passwords and cannot see gaps that only show from the inside. For anything that matters, a closer look by hand is worth it.
The address you enter is processed for the analysis. See the privacy policy.