What does this Website Security Checker test?
Novaverb performs a limited external check of a public website: it verifies the TLS certificate presented on port 443, reads selected HTTPS response headers, notes visible server identifiers, and attempts TCP connections to seven commonly reviewed service ports. The output is point-in-time evidence - not a full vulnerability scan, malware scan or penetration test.
How the free website security check works
Validate the target
The checker accepts only a publicly routable hostname and rejects private or reserved network targets.
Verify TLS
It opens a live TLS connection, verifies the hostname and certificate chain, then records the negotiated version and cipher.
Read one response
It requests the HTTPS homepage and records six selected policy headers plus visible server identifiers.
Attempt seven ports
It attempts TCP connections to 21, 22, 23, 25, 3306, 5432 and 6379. A response means reachable, not vulnerable.
Measured evidence versus security claims
What this check can observe
- Whether a browser-trusted TLS certificate can be verified for the hostname
- The negotiated TLS version and cipher suite for one connection
- Whether six selected HTTP security headers were declared on one response
- Whether seven selected TCP ports accepted a connection from the Novaverb probe
- Server and X-Powered-By identifiers returned in response headers
What this check cannot prove
- That the website is safe, hacked, malware-free or compliant
- That a declared CSP, HSTS or Permissions-Policy is complete and effective
- That every port is closed or that an answering service is exploitable
- The security of source code, plugins, packages, login flows, APIs or cloud accounts
- WAF effectiveness, internal network controls or attacks from other locations
How to prioritize the findings
- Fix certificate verification failures first. An expired, mismatched or untrusted certificate can block users and removes authenticated HTTPS protection.
- Review reachable database, Redis and Telnet services. Confirm ownership, business need, authentication, patch state and network allowlists. Do not infer a breach from reachability alone.
- Validate policy values, not just header names. A weak CSP or max-age=0 HSTS declaration may provide little or no protection even though the header exists.
- Reduce unnecessary implementation disclosure. Hide detailed version banners where practical, but patching and secure configuration remain the real controls.
- Run authenticated and application-layer testing separately. Use code review, dependency scanning, access-control tests and an authorized penetration test for deeper assurance.
Standards behind these checks
The page distinguishes observation from interpretation and links to the primary specifications used to explain each signal.
Website Security Checker questions
Does a high result mean my website is secure?
No. This page intentionally does not create a general security score. It reports a small set of externally observable configuration signals.
Is an open port automatically a vulnerability?
No. A successful TCP connection only shows that something answered from this probe location. Risk depends on the service, authentication, patching, exposure policy and configuration.
Does a present security header mean it works?
No. Presence is only the first check. The value may be syntactically invalid, overly permissive, scoped incorrectly or incompatible with the application.
Why can a header result be unavailable instead of missing?
If the HTTPS request times out or cannot retrieve response headers, there is no evidence to call a header missing. The checker keeps that distinction explicit.
Does this tool test XSS, SQL injection or malware?
No. It sends no attack payloads and does not inspect application code, databases, files, accounts or dependencies.
Why is HTTPS not a complete security guarantee?
TLS protects authentication, confidentiality and integrity in transit. It does not fix vulnerable code, weak passwords, stolen accounts or unsafe server configuration.
This is a non-intrusive external probe of TLS, response headers and a few common ports - not a vulnerability scan or penetration test, and it cannot prove a site is secure.