Type a website address to get a quick security report. The checker loads the site the way a browser does and tests the basics every site should have: a valid HTTPS certificate, a redirect from http:// to https://, modern TLS, and the security headers that protect visitors from cross-site scripting, clickjacking and content sniffing.
It also looks at cookie flags, version numbers leaked in headers, insecure http:// resources on HTTPS pages, security.txt, and the SPF, DMARC and CAA records that stop others from sending email in your name or issuing certificates for your domain. Each problem comes with a short explanation and the exact header or record to add.
How to use the Website Security Checker tool
- Type the address of the site, for example
example.com(https:// is added for you). - Click Check security and wait a few seconds.
- Read the grade and the list of passed, warning and failed checks.
- Use the 💡 suggestions to fix problems on your server, then click Scan again.
Why use ToolOrca Website Security Checker
- HTTPS, certificate expiry and TLS version
- HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy
- Secure, HttpOnly and SameSite cookie flags
- Mixed content and third-party scripts on the home page
- SPF, DMARC and CAA DNS records
- Score out of 100 with a grade from A+ to F, plus copy-paste fixes
What the grade means
Each check has a weight: HTTPS and the redirect count most, then HSTS and Content-Security-Policy, then the smaller headers, cookies and email records. A passed check earns its full weight, a warning half. A+ (95 or more) means the site follows current best practice; C or lower means visitors are missing important protections.
The checker only looks at the public home page and its headers. It does not try to break in, test passwords or scan for vulnerabilities in your code, so a good grade does not prove that a site is secure – it shows that the basic protections are switched on.
Recommended headers
A good starting set for most sites: Strict-Transport-Security: max-age=31536000; includeSubDomains, X-Content-Type-Options: nosniff, X-Frame-Options: SAMEORIGIN, Referrer-Policy: strict-origin-when-cross-origin, Permissions-Policy: camera=(), microphone=(), geolocation=() and a Content-Security-Policy that lists only the sources your pages use.
Add them in your web server (Apache Header always set, nginx add_header … always), in your hosting control panel, or in a CDN such as Cloudflare. Test a strict CSP with Content-Security-Policy-Report-Only first so you do not break scripts or ads.
Privacy and limits
Scans run on our server because a browser is not allowed to read another site's headers. Only public websites on ports 80 and 443 can be checked; private network addresses are refused. Results are kept for ten minutes so repeated scans are fast, and each visitor can run a few scans per minute.
Frequently asked questions
Is it safe to scan my website?
Yes. The checker makes a few normal page requests, like a visitor would. It does not attack or stress your site.
Why does my site fail Content-Security-Policy?
Most sites have no CSP. Add one that allows only your own scripts and the services you use (analytics, ads, fonts). Start in report-only mode to find what to allow.
Why are SPF and DMARC in a website check?
They protect your domain's email. Without them, scammers can send emails that look like they come from your domain.
Can I check a site on my local network?
No. For safety, private and local addresses (such as 192.168.x.x or localhost) are not allowed.
How often can I scan?
A few scans per minute per visitor. Results are cached for 10 minutes; use Scan again to force a fresh check.