12 pts
HTTPS
Whether the site is served over an encrypted connection and upgrades plain HTTP visitors.
- Site loads over HTTPS
- HTTP redirects to HTTPS
Free · No sign-up · Results in seconds
How secure is your website?
Enter a domain to get an A+ to F security grade. We check HTTPS, the TLS certificate, security headers, email spoofing protection and cookies, then explain every issue in plain English with how to fix it.
What we check
Eight areas, weighted by how much they matter for real-world attacks. The weights add up to 100 points.
22 pts
TLS certificate & protocols
Certificate validity and strength, and which TLS protocol versions the server still accepts.
- Trusted, matching certificate
- Expiry
- TLS 1.0–1.3 support
- Key strength
- Signature
- Chain & SANs
32 pts
Security headers
HTTP response headers that tell browsers to enable built-in protections.
- HSTS
- Content-Security-Policy
- X-Frame-Options
- X-Content-Type-Options
- Referrer-Policy
- Permissions-Policy
8 pts
Cookies
Security flags on cookies set by the homepage.
- Secure
- HttpOnly
- SameSite
5 pts
Information leakage
Headers that reveal server software and versions to attackers, and the technologies we could detect.
- Server version
- X-Powered-By
- Technology fingerprint
12 pts
Email security
DNS records that stop attackers from sending email pretending to be this domain.
- SPF record
- DMARC policy
6 pts
DNS security
CAA records that restrict who can issue certificates, and DNSSEC signatures on DNS answers.
- CAA record
- DNSSEC
3 pts
Public files
security.txt for reporting vulnerabilities, and what robots.txt reveals.
- security.txt
- robots.txt
How grades work
A+ needs 95+ points and no failed checks. No HTTPS means F; an untrusted certificate caps the grade at D, a weak key at C, and accepting TLS 1.0/1.1 at B. Full breakdown
- A+ 95+
- A 85+
- B 70+
- C 55+
- D 40+
- F <40