Website Security Check

HTTPS encrypts everything between your visitors and your site: passwords, forms and payment details. Browsers label sites without it “Not secure”.

People still type and click http:// links. Without a redirect, those visits stay unencrypted and can be read or changed on public Wi-Fi.

HSTS tells browsers to use only HTTPS for your site, which blocks “SSL stripping” attacks on the first request. OWASP names it as the way to enforce HTTPS.

An https:// page that loads scripts, styles or images over http:// is only partly encrypted. Browsers block the scripts and styles, which breaks the page, and someone on the network can swap the rest.

Anything typed into a form on an http:// page, or into a form that posts to an http:// address, travels in clear text: passwords, phone numbers, payment details.

A Content-Security-Policy tells browsers which scripts may run on your pages. If an attacker manages to inject code (cross-site scripting, part of A05 Injection), a strict policy keeps it from running.

Without it, another site can load yours in an invisible frame and trick visitors into clicking buttons they cannot see, like “Delete”, “Pay” or “Confirm”.

It stops browsers from guessing file types, so a file uploaded to your site cannot be run as a script or a stylesheet.

It controls how much of your page addresses other sites see when visitors follow a link. Full addresses can contain private details such as search terms or order numbers.

It switches off browser features you do not use (camera, microphone, location, payment), so an injected script or a third-party frame cannot use them.

Session cookies keep people signed in. Without Secure they can leak over http://; without HttpOnly an injected script can steal them; without SameSite other sites can send requests with them.

Version numbers in headers and error pages tell attackers exactly which known vulnerabilities to try. Hiding them fixes nothing on its own, but it stops making their job easy.

Software past its end of life no longer gets security fixes: every vulnerability found after that date stays open for good.

Outdated WordPress, Joomla or Drupal sites are the most common way small business websites get hacked, usually by bots that look for known holes.

Old copies of popular libraries such as jQuery, Bootstrap or AngularJS have published vulnerabilities, often cross-site scripting. Attackers scan for them automatically.

Every script loaded from another site runs with full access to your pages. In 2024 the polyfill.io domain changed hands and was used to inject malware into more than 100,000 websites.

Stack traces, database errors and debug pages reveal file paths, software versions and sometimes passwords. They show attackers where to aim.

SPF and DMARC tell mail providers which servers may send email for your domain. Without them, anyone can send phishing emails that look like they come from you, and your real emails land in spam more often.

A security.txt file (RFC 9116) tells researchers how to report a vulnerability to you, so a problem reaches you before it reaches attackers.