Is my website secure? Check it free.
Type your website address and see the security settings your site shows in public, the same ones any visitor's browser can see. It works on any platform. Nothing to install, and we don't ask for anything else.
Check your website now.
What your results mean.
Good. The setting is there and working.
Improve. The setting is missing or weaker than it should be. Each result says what it means in plain words.
Problem. Something your visitors can run into, like an expired certificate. Fix these first.
Info. Useful to know, but not graded either way.
Set by platform. Some settings are controlled by your website platform, not by you. We show them so you know, but we don't count them against you.
If the check is turned away. Your site's bot protection may block our automated check. That isn't a fault on your site. Try again later, or ask us to look by hand.
What this check can't see.
It only reads what your site shows in public. It doesn't log in, guess passwords or look for hidden files, so it can't tell you:
- whether your software and plugins are up to date
- whether your passwords are strong
- whether you have working backups
- whether your site has already been hacked
A good result is a good sign, not a guarantee. If you want someone to look at the parts it can't see, talk to us in live chat.
Does this check hack or scan my site?
No. It loads your site the way any visitor's browser does and reads what your site sends back in public. It doesn't log in, guess passwords or look for hidden files.
Does it work on Shopify, Wix, Squarespace or WordPress?
Yes. It works on any website with a public address, whatever it is built on. Where your platform sets something you can't change yourself, the result says so and doesn't count it against you.
Why does it say the check was blocked?
Some sites have bot protection that turns away automatic visits, including this check. That is not a fault on your site. Try again later, or ask us in live chat and we'll look by hand.
If everything looks good, is my site safe?
Not for certain. This check only sees the public settings. Out-of-date software, weak passwords and missing backups don't show from the outside, so a good result is a good sign, not a guarantee.
What do you do with the address I type?
We use it to run the check, and we keep the result with your site's address for up to one hour so a repeat check loads fast. The check doesn't ask for your name, email or anything else. To limit checks to 5 an hour, your connection address is kept only in scrambled form, and that also expires after an hour.