Web server security tool
Website Security Checker
Test the SSL certificate and chain, TLS versions and ciphers, HTTPS setup, security headers, exposed files and DNS records of any website. Each finding comes with a copy-ready fix.
Check a website
Checking…
This usually takes 5–30 seconds, depending on the server.
- Resolving DNS and validating the target
- Checking certificate, chain and trust
- Testing TLS versions and cipher suites
- Loading the start page and analyzing headers
- Looking for exposed files and version leaks
- Checking DNS and e-mail records
Security report
–
Fix these first
All checks
What You Can Check
More than 25 checks around the web server, grouped by topic and weighted by risk.
- Certificate trust, host name, expiry, chain order and key strength
- TLS 1.0–1.3 support, weak ciphers and forward secrecy
- HTTPS redirect, HSTS, CSP and other security headers
- Cookie flags, mixed content and version disclosure
- Exposed .git, .env, phpinfo and server-status files
- CAA, SPF, DMARC, MTA-STS and IPv6 records
Typical Risks
Most incidents on small and mid-sized websites start with configuration gaps, not with sophisticated attacks.
- Expired certificates or missing intermediates block visitors and API clients
- A public .git or .env file leaks source code, passwords and API keys
- Missing HSTS allows SSL stripping in public Wi-Fi networks
- Announced outdated versions attract automated exploit scanners
How the Grade Works
Every open finding lowers the score of 100 by its severity. The grade summarizes the result.
- A+: no medium or higher finding and HSTS enabled
- A–D: score 90, 80, 70 and 55 or more
- Enabled TLS 1.0/1.1 caps the grade at B
- Any critical finding (e.g. untrusted certificate) means F
Examples, Do's and Don'ts
Solid Baseline (nginx)
ssl_protocols TLSv1.2 TLSv1.3;add_header Strict-Transport-Security "max-age=31536000" always;add_header X-Content-Type-Options "nosniff" always;server_tokens off;andexpose_php = Off
Do
- Automate certificate renewal and monitor expiry
- Roll out CSP in report-only mode first
- Retest after every server or hosting change
Don't
- Deploy with .git, .svn or .env in the web root
- Enable HSTS preload before all subdomains use HTTPS
- Keep TLS 1.0/1.1 "just in case"
Frequently Asked Questions
Is the security check safe for my web server?
Yes. The checker performs a few TLS handshakes, loads the start page, requests eight well-known paths such as /.git/HEAD and reads public DNS records. It does not scan ports, guess passwords or send attack payloads, and each domain can be checked at most ten times in ten minutes.
How is the grade calculated?
The score starts at 100 and every open finding deducts points by severity: critical 40, high 15, medium 7 and low 2. Any critical finding results in grade F, enabled TLS 1.0 or 1.1 limits the grade to B, and A+ requires HSTS and no finding of medium or higher severity.
Why is my certificate chain reported as incomplete although the browser shows a padlock?
Desktop browsers often download a missing intermediate certificate on their own. Many mobile devices, API clients, curl and Java do not and fail the connection. Configure the full chain file on the server, for example fullchain.pem with Let's Encrypt.
Can I trust the warnings about outdated software versions?
The checker rates the version numbers your server announces, for example in the Server or X-Powered-By header. Linux distributions often backport security fixes without changing the version number, so verify the installed package version before upgrading. Hiding the version is recommended either way.
How often should I check my website?
After every change to the server, hosting, CDN or certificate, and at least once a month. Certificates expire and new vulnerabilities are published, so a clean result can change over time.
A good result does not replace updates, backups, or a review of your application code. Related tools: analyze SPF include chains with the SPF Checker and find mixed content and broken links on every page with the 404 Checker.