How the security check works.

Start with your website address

Enter a website you own or have permission to assess. We request its public pages, inspect the content and settings they return, and run selected connection checks. You do not need to install anything or give us a password.

The scan gathers public evidence. It does not try to break into your website.

What we check

Your website’s connection

We check HTTPS, whether the certificate is trusted and valid, and whether visitors using HTTP are directed to a protected connection. Selected TLS tests review supported encryption protocols, cipher groups and certificate settings.

Protections for visitors

We inspect browser instructions that help protect visitors, such as restrictions on scripts, embedded pages and how files are interpreted. We also check recognised session cookies for security settings and look for insecure active resources or forms referenced by the pages.

A missing optional setting is not automatically a vulnerability. The report explains the context and whether a finding needs confirmation.

Public software clues

Page content, headers and selected same-site scripts can reveal a platform, library or version. Where we recognise supported software and have enough information, we compare those clues with published security warnings.

A public version can be incomplete, misleading or already patched by a host. A warning is a reason to investigate, not proof that your installation can be exploited.

Signs of harmful content

We scan a limited set of retrieved public files for known harmful-code signatures and look for suspicious patterns in page content. Where available, we also compare relevant website addresses with threat lists.

A match needs investigation. An unavailable check or a report with no matches cannot rule out a compromise.

Public information and crawl instructions

We note information such as visible platform clues, outside services, robots instructions, indexing directives, sitemaps and security contact details. These observations help explain what is publicly visible; their presence alone is not a security problem.

How much of the site is scanned?

This is a bounded check, not an inventory of your entire website. We inspect up to ten eligible public pages on the final site origin, plus selected supporting resources. A site may allow us to inspect fewer pages.

We limit requests, downloads and scan time, follow supported robots rules for additional crawling, and avoid private network addresses and action-oriented paths. We do not execute the website’s JavaScript, so content that only appears after scripts run may be outside the scan.

The report records coverage and limitations so you can see what was actually assessed.

What we do not check

• Private server files, databases, backups or source code that is not publicly served.
• Signed-in areas, admin dashboards or the strength of your passwords and account recovery.
• Every page, subdomain, plugin, dependency or outside service used by the website.
• Whether checkout, payments, permissions or other business processes can be abused.
• Every vulnerability or new malware variant, or whether the site has ever been compromised.
• Protection against every bot or AI-assisted attack.

We do not submit forms, guess credentials, attempt exploits or change your website’s content. This check does not replace a penetration test, an internal security review or incident investigation.

How to read your report

Start with the overview and the items that need attention. Each finding explains the concern, the available evidence and a practical next step. Some issues can be checked by your host; others need your developer to confirm what is installed and how it is used.

The score summarises the public protections and supported software checks assessed. It is not your chance of being hacked. A score range reflects uncertainty, and checks that could not finish are not counted as passes.

A high score is not an all-clear. Read the coverage and limitations alongside it.

Why a check may be incomplete

A website may block automated requests, respond slowly or expose too little information to assess a setting or software version. An outside warning source may also be unavailable. Connection and file checks can take longer on some sites.

We report those gaps instead of inventing a clean result. An incomplete check means missing information, not a confirmed problem with your website.

Your report stays private until you share

Your detailed report is available through the browser session that created it and is retained for up to seven days.

Clicking Copy share link publishes a limited summary and copies its link. Anyone with that link can view the site address, score, assessment date, coverage limits and any high-level threat alerts included in the summary. Detailed findings and original evidence stay private.

You can unpublish the summary, and it expires with the scan. If you download a report or share an image, copies held by other people are outside our control.

What to do next

Use the report as a starting point. Share the relevant evidence with your developer or host, confirm any software warnings and address the highest-priority concerns first. Run a new check after changes to see what the public evidence shows.

No outside scan can certify that a website is completely safe.