Check a website’s security
Enter a domain and we analyse its external security posture: protective HTTP headers, whether it enforces HTTPS and the state of its TLS certificate. We give you a score and what to improve. We only observe what is public: never an intrusive scan.
Privacy: we only analyse public information about the domain. We do not store the domain or the result; only an anonymous counter (hash) for the daily anti-abuse quota.
Non-intrusive analysis: we only observe what the site exposes publicly. We never probe or attack internal or private addresses.
Website-Check
Analyse the security posture of any domain
A well-configured website protects its visitors with a set of HTTP headers and a valid TLS certificate. When they are missing, the site is exposed to attacks such as clickjacking, content injection or traffic interception. This tool analyses the external security posture of a domain in seconds and for free, and tells you what to improve — no sign-up required.
How it works
Step 1 · Enter a domain. Just the name (e.g. example.com) or a URL. The anti-bot check is invisible in most cases.
Step 2 · We observe what is public. We fetch the site’s home page and read its security headers, check whether it enforces HTTPS, and open a TLS connection to read the certificate. External observation only: never an intrusive scan.
Step 3 · Full score, free. We give you a score out of 100 with a grade (A to E), a breakdown of each header (present or absent), the TLS certificate state and a list of actionable recommendations.
What we check
- HSTS (Strict-Transport-Security) — forces the browser to always use HTTPS.
- CSP (Content-Security-Policy) — restricts where scripts and resources load from (mitigates XSS).
- X-Frame-Options — stops your site being embedded in iframes (clickjacking).
- X-Content-Type-Options — stops the browser guessing MIME types.
- Referrer-Policy — controls what referrer information is sent to third parties.
- Permissions-Policy — restricts browser APIs (camera, microphone, geolocation…).
- HTTP → HTTPS redirection — so nobody browses unencrypted.
- TLS — protocol version and days until the certificate expires.
Non-intrusive analysis (Level 0)
We only observe what the site exposes publicly, just as any browser would. We do not launch attacks, we do not test vulnerabilities and we do not access internal or private addresses. For safety, we reject any target pointing to localhost, a private IP or reserved ranges: the tool is for analysing public third-party sites for legitimate purposes.
Privacy
- We do not store the domain you check or the analysis result.
- We only keep an anonymous counter (hash) for the daily anti-abuse quota of 5 analyses per day.
- The analysis runs in real time and is discarded afterwards.
What to do with the result
1. Prioritise the highest-severity findings (HTTPS redirection, HSTS, CSP and TLS).
2. Add the missing headers on your web server or CDN — most are a single configuration line.
3. Renew the TLS certificate ahead of time if it is close to expiring.
4. Re-analyse after applying the changes to confirm the improvement.
Managing several domains? Sign up for free at OCIRIA Security and monitor their posture continuously.