Free Website Security Scan
Scan any website's external security posture for free and get an A–F grade in seconds. We read your HTTP headers, TLS configuration and exposed files and turn them into one clear score — with the fixes that move it.
This tool reads publicly available configuration (HTTP response headers). It performs no intrusive testing. Only scan domains you own or are authorized to assess.
What goes into the score?
The grade combines five external, passive signals weighted by impact: your HTTP security headers (HSTS, CSP and friends), your TLS/SSL configuration (certificate validity and protocol strength), whether sensitive files or endpoints are exposed (think a public .git or .env), your cookie flags (Secure, HttpOnly, SameSite on session cookies), and your email authentication records (SPF, DMARC, DKIM).
Each area is scored out of 100, then combined into a single 0–100 number and an A–F letter. One catastrophic issue — like an exposed source repository — caps the grade no matter how clean the rest is, so a high average can't hide a single critical leak.
This is the same passive read any visitor's browser could make; it performs no intrusive testing. It deliberately does not flag version-based CVEs — those are reserved for the authenticated full scan, because guessing a CVE from a version banner produces false alarms.
How to raise your grade
Work top-down — fix anything that caps the grade first, then chip away at warnings:
- Close any exposed file or endpoint immediately (.git, .env, backups) — these cap the grade at F.
- Fix TLS: a current certificate from a trusted CA, and TLS 1.2+ only.
- Add the core security headers: HSTS, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options.
- Re-scan after each change — the score updates immediately.
Want the full background? Read the in-depth guide →
Frequently asked questions
How is the grade calculated?
Each category (headers, TLS, exposed files, cookies, email authentication) starts at 100 and loses points per issue by severity. The categories are weighted by impact and combined into a 0–100 score and an A–F band. Any critical issue caps the grade at F; any high caps it at C.
Why don't you show CVEs in the score?
The open score is passive and infers nothing from version banners — guessing a CVE from a version string is a common source of false CRITICALs. Known-exploited-CVE checks are part of the full external scan instead.
My grade says “partial” — what does that mean?
On very large sites one check (usually the exposed-files scan) can't finish within the time budget. We grade on what completed and flag the result as partial rather than make you wait. Re-run for a full read.
Is it free?
Yes — free and open, no signup. For a deeper look across subdomains, open services and known-exploited CVEs, see the full external scan (coming soon).