Free tool: website security check
Is your business website set up safely?
Type your website. In a few seconds you will see the certificate, whether every visitor is sent to the secure version, and which standard protections are missing. It only loads your home page, the way any visitor would.
What it checks
Read the same way a mail server or a browser reads it
- Certificate
- Whether it is valid, who issued it, and how long until it expires. An expired certificate puts a full page warning in front of every customer.
- HTTPS everywhere
- Whether someone who types your address without https is sent to the secure version, or left on the plain one.
- Security headers
- HSTS, a content security policy and frame protection: the instructions that stop a browser being tricked into downgrading the connection, running injected scripts, or showing your site inside someone else’s.
- What the site announces
- Whether the server or the site builder tells every visitor its name and version, which is the first thing an automated attack looks for.
Why it matters
What this has to do with a small business
Most small business websites are never attacked by a person. They are found by software that scans the whole internet for known weaknesses, usually an old version of WordPress or a plugin, and tries the same trick on every one it finds.
None of what this checks needs a developer to understand. Each finding says what it means and what to ask whoever looks after your site.
Questions
What people ask about this
Is my website secure if it has the padlock?
The padlock means the connection is encrypted. It says nothing about whether the site itself is up to date, or whether it tells browsers to refuse the tricks that headers are there to stop.
What are security headers?
Short instructions your website sends with every page telling the browser what it may and may not do: always use HTTPS, only run scripts from these places, never show this page inside another site.
My site is on Wix or Squarespace. Does this matter?
Less, because the platform handles most of it and keeps itself updated. The certificate and the HTTPS redirect are still worth checking, and anything missing is a question for their support team rather than a job for you.
Does this scan my website?
No. It loads your home page once, exactly as a visitor would, and reads what comes back. It does not probe, crawl or test for vulnerabilities.
More free tools
All free toolsStart with one visit
Tell us about the business and roughly how many computers. We will come back with a price and a date.