What you get for free
- TLS certificate
- Expiry date and days remaining, with a flag when fewer than 30 days remain.
- Security headers
- Published browser controls, including CSP, HSTS, framing, content-type, referrer and permissions policies.
- Email policies
- The published SPF and DMARC policies. Receiver behaviour depends on authentication results and local policy.
- Cookie flags
- The protection flags on cookies set by the homepage response.
- Public information
- Version-disclosing headers and the presence of robots.txt and security.txt.
Missing settings may need review; their importance depends on the website. A partial check cannot establish that a site is secure.
What a paid plan adds
Full scans check verified domains for known vulnerability fingerprints. Paid plans also include weekly or monthly monitoring, email notifications when results change, scan history and reports with your agency’s name and logo.
Choose a plan for five, ten or forty websites. Verify each domain with a DNS record or a hosted file before starting a full scan.
What the public check requests
It reads the HTTPS homepage, /robots.txt and /.well-known/security.txt, looks up SPF and DMARC in public DNS and opens a TLS connection to read the certificate.
It does not guess paths, test vulnerability fingerprints, submit forms or attempt a login. Redirects are not followed; response sizes and request times are limited. If something cannot be read, the result says so.
For details or to block these requests, see About our checks.
Common questions
Is the free website security check really free?
Yes. It needs no account. Paid plans add full scans on verified domains, scheduled monitoring and branded reports.
What does the public check request?
The HTTPS homepage, /robots.txt and /.well-known/security.txt, public DNS for SPF and DMARC, and a TLS connection to read the certificate. It does not guess paths, submit forms or attempt a login.
Can a clean result prove my site is secure?
No. A partial check reports what a site publishes; missing settings may need review, and their importance depends on the website.
Understand your results
- SSL certificate checkerRead one certificate’s expiry date and the days left, free.
- Certificate expiryCheck the renewal date and the certificate visitors receive.
- HSTS checkerIs HTTPS enforced, and for how long?
- Security headersWhat each of the six headers prevents, and what a missing or weak one allows.
- SPF and DMARCUnderstand the published policy without assuming mail delivery is guaranteed.
- What a full scan can tell youKnown patterns, evidence and results that need review.