Free Site reachable over HTTPS Confirms a secure connection can be made at all. Free Certificate not expired Expired certificates show every visitor a full-page warning. Free Certificate expiring soon Warns 14 days ahead so you are never caught out. Free Certificate matches your domain A certificate for the wrong name is as bad as none. Free Not self-signed Self-signed certificates are not trusted by any browser. Free Strong signature algorithm Flags weak SHA-1 or MD5 signatures. Free HTTP redirects to HTTPS Makes sure nobody can use the insecure version of your site. Free HSTS enabled and strong Tells browsers to always use HTTPS for your site. Free No mixed content Finds insecure images or scripts loaded on secure pages. Verified Old TLS versions disabled TLS 1.0 and 1.1 are broken and should be off. Verified Weak cipher suites Outdated encryption methods an attacker can crack.

Free Content-Security-Policy present The strongest defence against injected malicious scripts. Free CSP not weakened by unsafe-inline A CSP that allows inline scripts protects far less. Free Clickjacking protection Stops your site being hidden inside an attacker's page. Free X-Content-Type-Options: nosniff Stops browsers guessing file types in dangerous ways. Free Referrer-Policy set Stops private URLs leaking to other sites. Free Permissions-Policy set Locks down camera, microphone and location access. Free CORS not dangerously open Checks other websites cannot read your users' private data. Free Software versions not leaked Server and framework versions hidden from attackers.

Free Cookies marked Secure Login cookies only ever sent over HTTPS. Free Session cookies HttpOnly Stops scripts stealing the cookie that keeps you logged in. Free Cookies use SameSite Blocks a whole class of cross-site request forgery attacks.

Free .git repository not exposed Your entire source code and history, readable by anyone. Free .env file not exposed The file that usually holds your database password and API keys. Free Backup .env not exposed Old copies of secrets left behind. Free phpinfo page not exposed A full map of your server configuration. Free .htpasswd not exposed Password file for protected areas. Free Server status page not exposed Live requests and server internals. Free WordPress config backup not exposed wp-config backups contain your database login. Free .DS_Store not exposed Leaks the names of files in a folder. Free Backup archives not in web root Whole-site .zip backups downloadable by anyone. Verified Directory listing off Stops folders showing their full contents. Verified Installer and debug pages removed Leftover setup pages and debug output.

Free PHP2Shell (CVE-2026-109618/9) The critical remote-code-execution flaw. Checks your PHP is patched. Free Technology fingerprint Identifies your CMS, server and libraries to check versions. Verified Known CVEs in detected software Matches versions against published vulnerabilities. Verified Vulnerable JavaScript libraries Old jQuery, Bootstrap and friends with known holes. Verified WordPress plugins and themes Enumerates versions against the vulnerability database.

Free SPF record present Stops strangers sending email as your domain. Free SPF not dangerously permissive A +all record is worse than none. Free DMARC record present Tells mail providers to reject fake emails from you. Free DMARC enforcing (not just monitoring) p=none reports fakes but does not block them. Free CAA record present Restricts who may issue certificates for your domain.

Verified Subdomain discovery Finds every subdomain an attacker could find. Verified Subdomain takeover Dangling records pointing at unclaimed services. Verified Open ports and services Databases and admin services facing the internet. Verified Nuclei template scan Thousands of known-issue templates run safely against your site.