Is your website well protected?
Enter your website address: we check its encryption, security headers, cookies and the information it reveals, with a clear grade, like professional scanners.
Passive, risk-free analysis: we only read your website's public responses. No intrusion, no data kept.
Encryption
The website must be served over HTTPS: the basis of trust, and Google takes it into account.
The http:// version must redirect to https://, otherwise a visitor may browse unencrypted without knowing.
The certificate must be valid and renewed in time.
Security headers
Forces the browser to always use HTTPS, from the very first visit.
Limits what the page is allowed to load, the best defence against script injection (XSS).
Prevents your website from being embedded in a trap page to hijack your visitors' clicks.
Prevents the browser from "guessing" file types, a classic attack vector.
Controls the information passed to third-party sites when a visitor clicks a link.
Disables unnecessary sensors (camera, microphone, geolocation…) for the page.
Cookies
Cookies must carry the Secure and HttpOnly attributes so they cannot be stolen or read by a script.
Server discretion
A chatty Server header reveals potentially attackable versions.
Announcing your PHP version hands over the list of flaws to try.
The "generator" tag reveals the exact version of WordPress & co. better hidden.