1. Source
One live TLS handshake, HTTPS response, and seven selected TCP-port probes. The result identifies where its evidence came from.
Free tool, no account required
Free Website Security Audit & SSL Checker
Audit website security posture, TLS/SSL certificates, HTTP security headers, and open ports with instant live evidence. Free online security check.
Also known as: SSL checker, security headers test
Evidence shown with sourceNo account requiredNo invented metrics
Run a real check above
Submit a public URL, domain, or keyword. Novaverb will show only the evidence this tool can actually retrieve or measure.
Evidence model
Know what the result proves
This limited external check reads the TLS certificate, negotiated TLS version, presence of six selected security response headers and reachability of seven common TCP ports for the exact submitted hostname. It does not expose raw infrastructure fingerprints in the public result and cannot prove that the application itself is secure.
2. Boundary
This is a limited, non-intrusive external probe - not a vulnerability scan or penetration test. It cannot prove that a website is secure or compromised.
3. Next action
Use the finding to verify a problem, then connect a workspace when you need history, monitoring, or site-wide analysis.
What does this Website Security Checker test?
Novaverb performs a limited external check of a public website: it verifies the TLS certificate presented on port 443, reads selected HTTPS response headers, notes visible server identifiers, and attempts TCP connections to seven commonly reviewed service ports. The output is point-in-time evidence - not a full vulnerability scan, malware scan or penetration test.
How the free website security check works
Validate the target
The checker accepts only a publicly routable hostname and rejects private or reserved network targets.
Verify TLS
It opens a live TLS connection, verifies the hostname and certificate chain, then records the negotiated version and cipher.
Read one response
It requests the HTTPS homepage and records six selected policy headers plus visible server identifiers.
Attempt seven ports
It attempts TCP connections to 21, 22, 23, 25, 3306, 5432 and 6379. A response means reachable, not vulnerable.
Measured evidence versus security claims
What this check can observe
- Whether a browser-trusted TLS certificate can be verified for the hostname
- The negotiated TLS version and cipher suite for one connection
- Whether six selected HTTP security headers were declared on one response
- Whether seven selected TCP ports accepted a connection from the Novaverb probe
- Server and X-Powered-By identifiers returned in response headers
What this check cannot prove
- That the website is safe, hacked, malware-free or compliant
- That a declared CSP, HSTS or Permissions-Policy is complete and effective
- That every port is closed or that an answering service is exploitable
- The security of source code, plugins, packages, login flows, APIs or cloud accounts
- WAF effectiveness, internal network controls or attacks from other locations
How to prioritize the findings
- Fix certificate verification failures first. An expired, mismatched or untrusted certificate can block users and removes authenticated HTTPS protection.
- Review reachable database, Redis and Telnet services. Confirm ownership, business need, authentication, patch state and network allowlists. Do not infer a breach from reachability alone.
- Validate policy values, not just header names. A weak CSP or max-age=0 HSTS declaration may provide little or no protection even though the header exists.
- Reduce unnecessary implementation disclosure. Hide detailed version banners where practical, but patching and secure configuration remain the real controls.
- Run authenticated and application-layer testing separately. Use code review, dependency scanning, access-control tests and an authorized penetration test for deeper assurance.
Standards behind these checks
The page distinguishes observation from interpretation and links to the primary specifications used to explain each signal.
RFC 9325, TLS recommendationsCurrent best-practice guidance for secure TLS deployment.
RFC 8446, TLS 1.3The TLS 1.3 protocol specification.
RFC 6797, HSTSHow browsers enforce future HTTPS connections.
W3C, Content Security PolicyPolicy delivery, parsing and browser enforcement.
WHATWG Fetch, nosniffNormative handling of X-Content-Type-Options: nosniff.
IANA, Service names and portsThe registry for conventional service-to-port assignments.
Website Security Checker questions
Does a high result mean my website is secure?
No. This page intentionally does not create a general security score. It reports a small set of externally observable configuration signals.
Is an open port automatically a vulnerability?
No. A successful TCP connection only shows that something answered from this probe location. Risk depends on the service, authentication, patching, exposure policy and configuration.
Does a present security header mean it works?
No. Presence is only the first check. The value may be syntactically invalid, overly permissive, scoped incorrectly or incompatible with the application.
Why can a header result be unavailable instead of missing?
If the HTTPS request times out or cannot retrieve response headers, there is no evidence to call a header missing. The checker keeps that distinction explicit.
Does this tool test XSS, SQL injection or malware?
No. It sends no attack payloads and does not inspect application code, databases, files, accounts or dependencies.
Why is HTTPS not a complete security guarantee?
TLS protects authentication, confidentiality and integrity in transit. It does not fix vulnerable code, weak passwords, stolen accounts or unsafe server configuration.
This is a non-intrusive external probe of TLS, response headers and a few common ports - not a vulnerability scan or penetration test, and it cannot prove a site is secure.
Get the right answer
What to submit - and what to avoid
Submit the public domain or any URL on it. The exact hostname, including www when supplied, is tested because different hostnames can terminate at different edges. Private and reserved targets are refused. A staging-host result says nothing about production unless both names reach the same deployed system.
Use it like this
yourdomain.comAny public site you own or are authorized to test. http or https, with or without www, a bare domain or a full path - we normalize it for you.https://www.yourdomain.comThe probe reads only what any browser can see - no login, no exploitation.Avoid this
Expecting a penetration testThis is a non-intrusive external probe, not an exploit scan - it cannot prove a site is secure or compromised.admin.internal.corpInternal or private hosts are blocked. Only publicly resolvable, authorized sites are checked.Public methodology
Exactly how this result is produced
The hostname is resolved to a public address before the TLS, HTTPS and port checks run. The response is checked for HSTS, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy. A present header means it was observed, not that its full policy was proven correct.
- We open a live TLS handshake and read the certificate, negotiated protocol version and cipher.
- We inspect the response headers for the six OWASP baseline security headers (HSTS, CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy).
- We note the disclosed Server banner and probe a small set of common TCP ports for exposure.
- We report each signal as present / missing / weak - never as a claim that the site is 'secure', because an external probe cannot prove that.
Built on public standards
The international standards this check applies
RFC 8446 defines TLS 1.3, RFC 6797 defines HSTS, W3C CSP Level 3 defines Content-Security-Policy, and the OWASP Secure Headers project identifies the selected header set. The report distinguishes observed presence from full configuration validation.
IETFRFC 8446
TLS 1.3
Reads the negotiated TLS version and certificate from a live handshake.
Read the specificationIETFRFC 6797
HTTP Strict Transport Security (HSTS)
Checks whether a Strict-Transport-Security header is present in the captured response.
Read the specificationW3CCSP Level 3
Content Security Policy
Checks whether a Content-Security-Policy header is present; it does not validate the full policy.
Read the specificationOWASPSecure Headers
OWASP Secure Headers Project
Compares your response headers against the OWASP baseline of six security headers.
Read the specificationWe list a standard only where this tool genuinely reads or measures against it. Where a signal is outside a live check, the result says so instead of implying coverage.
Common questions
Website Security Checker FAQ
What does the Novaverb Website Security Checker actually check?
It runs a limited external probe of a public site: the TLS certificate, six security response headers (HSTS, CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy), the disclosed Server header, and seven common TCP ports.
Is this the same as a penetration test or vulnerability scan?
No. It is a non-intrusive external probe that reads publicly visible signals only. It does not exploit anything, log in, or scan for CVEs, and it cannot prove a site is secure or that it is compromised.
How do I fix missing security headers flagged by the checker?
Add the missing headers at your web server or CDN edge. Start with HSTS (Strict-Transport-Security), X-Content-Type-Options: nosniff, and a Referrer-Policy, then build a Content-Security-Policy, which is the hardest to configure safely.
What is HSTS and why does it matter?
HSTS (HTTP Strict-Transport-Security) is a response header telling browsers to always use HTTPS for your domain, preventing protocol-downgrade and cookie-hijacking attacks. A good baseline is max-age of at least 31536000 seconds (one year).
Which security response headers should every site send?
The OWASP Secure Headers baseline includes Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and Permissions-Policy. The checker reports which of these six are present, missing, or misconfigured.
Why does exposing my Server header matter?
A detailed Server header (naming software and version) hands attackers a version fingerprint to match against known exploits. Suppressing or genericising it via server config removes an easy reconnaissance signal, though it is hardening, not a real fix.
What is the difference between a TLS certificate check and this security scan?
A certificate check alone confirms encryption is valid and unexpired. This scan reads the certificate too, but adds response headers, the Server banner, and open ports, giving a broader external hardening snapshot rather than a single trust signal.
What is a good result for the open-ports part of the check?
Ideally only the ports you intend to serve publicly (typically 443, and 80 for redirects) respond. Exposed database, remote-desktop, or admin ports on a public host are worth reviewing and firewalling off.
Does a clean result here mean my website is secure?
No. A clean external probe means these specific public signals look healthy. It says nothing about application logic, authentication, unpatched software, or server-side vulnerabilities, so treat it as one input, not a certificate of security.
How does website security affect SEO?
Valid HTTPS protects data in transit and avoids browser security warnings. That supports visitor trust and reliable delivery, while this limited probe makes no claim about rankings or the site's full security posture.
More free checks
Explore all Novaverb Free Tools
Website SEO CheckerCrawl coverage, indexable pages, and internal links
Keyword Research ToolCheck the exact query's available search volume, keyword difficulty and …
SERP CheckerInspect the returned organic results for a keyword and country, …
WordPress Security Configuration CheckerCheck eight externally observable WordPress configuration areas: XML-RPC, wp-login.php, debug …
Server Response Time CheckerMeasure server Time to First Byte (TTFB), DNS lookup, TCP …
Backlink CheckerExplore backlinks, referring domains, dofollow links, and domain authority for …
Robots.txt CheckerTest and validate robots.txt rules, User-Agent directives, blocked paths and …
Sitemap CheckerDiscover sitemap declarations, inspect the root document and fetch a …
Meta Tag CheckerCheck page title length, meta description, H1 heading structure, Open …
HTTP Status & Redirect CheckerTrace HTTP status codes (200, 301, 302, 404, 500) and …
Website MonitorRun one live availability check and retain an evidence sample …
HTTP/2 TestCheck whether the exact submitted hostname negotiates HTTP/2 through TLS …
HTTP/3 TestTest whether your web server supports HTTP/3 over QUIC with …
Website Performance TestCompare HTTP response timing from available probe locations and inspect …
GEO CheckerInspect observable page signals that support retrieval, answer extraction, attribution …
Core Web Vitals CheckerCheck 75th-percentile real-user LCP, INP and CLS from Chrome field …
PageSpeed CheckerRun one Lighthouse lab audit to inspect performance, accessibility, best-practices …
Website Safety CheckerCheck whether a domain or URL is flagged for malware, …
Knowledge Graph CheckerLook up matching entities for a brand, person, product or …
Keyword Gap CheckerFind ranking keywords observed for a competitor and not observed …
Competitor Top PagesFind the pages with the highest estimated organic traffic in …