Shadow Steward
Free security check

Is your website doing the basics to keep visitors safe?

Type your website address. We read what your site tells every visitor, its https setup and security headers, and explain each gap in plain language. We never probe or attack anything.

We check the page you type. Add a page address to check that page instead of the home page.

We read your public page the way a visitor's browser would. Nothing is changed and nothing is stored. Read the privacy page.

What the check looks at

  • Secure connection. https everywhere, and http sent to https.
  • Security headers. HSTS, content security policy, framing, content type and referrer rules.
  • Cookies. Secure, HttpOnly and SameSite flags.
  • Insecure files. Pictures or scripts still loaded over plain http.
  • Forms. Whether they send data securely.
  • Information leaks. Software version numbers your site announces.

You get your score, a table of your security headers and what to fix.

More free checks

  • Titles: See how your title and search description look, and get better ones written for you.
  • Broken links: Find links on your page that lead nowhere, before your visitors do.
  • Page speed: Find the heavy pictures, blocking scripts and missing caching that slow your pages.
  • Accessibility: Check alt text, form labels, headings and more against common accessibility problems.
  • Image check: alt text, a better file name and a smaller copy of a picture.
  • SEO check: a full report by email.

Want to run this check from your own code? See the API.