Is your website actually locked down?
Enter any website and I'll check the things attackers probe first: the HTTPS redirect, the SSL certificate, security headers, cookie flags, and whether your server is leaking version numbers. Nine checks, one number, zero signup.
Checks HTTPS redirect, SSL expiry, HSTS, nosniff, clickjacking protection, cookie flags, and more. Read-only, nothing is stored.
What it checks
What your server sends to every visitor, scored out of 100.
- HTTP redirects to HTTPS
- HSTS header (Strict-Transport-Security)
- X-Content-Type-Options: nosniff
- Clickjacking protection (frame blocking)
- Content-Security-Policy header
- Referrer-Policy header
- Cookies flagged Secure and HttpOnly
- Server software versions hidden
- SSL certificate not close to expiry
The redirect from HTTP to HTTPS counts the most. The tool reads the same response any browser gets.