Free Website Security Checker: TLS, Headers and Open Ports

It runs a limited external probe of a public site: the TLS certificate, six security response headers (HSTS, CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy), the disclosed Server header, and seven common TCP ports.

No. It is a non-intrusive external probe that reads publicly visible signals only. It does not exploit anything, log in, or scan for CVEs, and it cannot prove a site is secure or that it is compromised.

Add the missing headers at your web server or CDN edge. Start with HSTS (Strict-Transport-Security), X-Content-Type-Options: nosniff, and a Referrer-Policy, then build a Content-Security-Policy, which is the hardest to configure safely.

HSTS (HTTP Strict-Transport-Security) is a response header telling browsers to always use HTTPS for your domain, preventing protocol-downgrade and cookie-hijacking attacks. A good baseline is max-age of at least 31536000 seconds (one year).

The OWASP Secure Headers baseline includes Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and Permissions-Policy. The checker reports which of these six are present, missing, or misconfigured.

A detailed Server header (naming software and version) hands attackers a version fingerprint to match against known exploits. Suppressing or genericising it via server config removes an easy reconnaissance signal, though it is hardening, not a real fix.

A certificate check alone confirms encryption is valid and unexpired. This scan reads the certificate too, but adds response headers, the Server banner, and open ports, giving a broader external hardening snapshot rather than a single trust signal.

Ideally only the ports you intend to serve publicly (typically 443, and 80 for redirects) respond. Exposed database, remote-desktop, or admin ports on a public host are worth reviewing and firewalling off.

No. A clean external probe means these specific public signals look healthy. It says nothing about application logic, authentication, unpatched software, or server-side vulnerabilities, so treat it as one input, not a certificate of security.

Valid HTTPS protects data in transit and avoids browser security warnings. That supports visitor trust and reliable delivery, while this limited probe makes no claim about rankings or the site's full security posture.