Free tool

Website Security Health Check

A passive best-practices scan — not a penetration test. It reads what your site tells every visitor anyway: response headers, the TLS certificate, cookie flags, and public DNS records. Every finding is mapped to published guidance from OWASP, MDN, NIST or an IETF RFC, with a link so you can check the reasoning yourself.

// roughly the same passive checks as securityheaders.com and Mozilla Observatory, with the "why" attached

I confirm I own this website or have permission to test it, and I agree to the Terms of Use.

What it does

· One HTTPS GET of the page you enter, following redirects
· One plain-HTTP GET to see whether visitors get upgraded
· TLS handshakes to read the certificate and protocol version
· Public DNS lookups: SPF, DMARC, CAA, MTA-STS, MX
· One request for /.well-known/security.txt

What it does not do

· No login attempts, password guessing, or form submission
· No port scanning — only ports 80, 443, 8080 and 8443 are reachable
· No payload injection, fuzzing, or path enumeration
· No crawling — it looks at one page, not your whole site
· Nothing that touches your database or application logic

Passive best-practices check, not a penetration test. Only scan sites you own or are authorized to test. See the Terms of Use.