Website security check
Check the protections your website switches on for its visitors: a trusted SSL certificate, the security headers browsers act on, cookie flags, and a redirect from http to https. Headers are graded A+ to F on the table below, so you can see exactly how the grade was worked out.
Header grade
The rest of your site, checked for €79
The Website Health Report includes this header grade and the certificate check, and adds what a security check cannot see: how long a phone waits for your pages, whether your email is authenticated, broken links and form destinations across up to fifty pages, when your domain registration runs out, and what search engines are told. Every finding comes with the evidence and a fix list in priority order. One payment of €79.
How the header grade is worked out
Each header earns points when it is present and set to a working value. The total decides the grade. Your certificate and the http to https redirect are shown alongside but are not part of the grade: they are pass or fail on their own.
| Header | Points |
|---|---|
| Strict-Transport-Security | 25 (10 if partial) |
| Content-Security-Policy | 20 (5 if partial) |
| X-Content-Type-Options | 15 |
| Frame protection (X-Frame-Options or CSP frame-ancestors) | 15 |
| Referrer-Policy | 10 |
| Permissions-Policy | 10 |
| Cookie flags (Secure and SameSite on every cookie) | 5 |
| Grade | Points |
|---|---|
| A+ | 100 |
| A | 85 to 99 |
| B | 70 to 84 |
| C | 55 to 69 |
| D | 40 to 54 |
| E | 25 to 39 |
| F | 0 to 24 |
Partial credit: Strict-Transport-Security sent with a max-age under 15552000 seconds (180 days), or a Content-Security-Policy sent in report-only mode. Cookie flags score when every cookie the page sets carries Secure and SameSite, or when it sets none.
What this check does not tell you
Headers and a certificate are protections a browser can apply. They are not evidence that a site is free of malware, that its software is up to date, or that its passwords are strong. A low grade is a list of free defences to switch on, not a sign of a breach.
Only want the certificate? The SSL certificate checker runs that part on its own. Read about keeping a site’s software up to date and what to do if a site has been hacked, or see all the free checks.
Website security checks, answered
What does the website security check look at?
Three things, from outside your site. Your SSL certificate: whether browsers trust it and when it runs out. Your security headers: the instructions your server sends that tell a browser how to protect visitors. And whether the plain http address of your site redirects to the secure https one.
Does a good grade mean my site is secure?
No. Headers are one layer. A site with an A+ can still run an out-of-date plugin with a known hole, and a site with a D may never have had a problem. This check tells you which free browser protections are switched on. It does not scan for malware, test your login page or look inside your site.
My site has no content security policy. Should I worry?
Not on a typical brochure site. Many small business sites have no Content-Security-Policy, and it is the header that takes most care, because it has to list every source of scripts, fonts and images the site uses. Treat it as worth adding, and add it in report-only mode first.
Who can add the missing headers?
Whoever manages your hosting or website. On most hosts headers are set in one configuration file or a settings screen, and on WordPress a security plugin can add several of them. It is a configuration change, not a rebuild.
Is this the same check the paid report runs?
Yes, the same code. The €79 Website Health Report shows the header grade as one finding in its Security section, alongside the certificate, and judges the http to https redirect separately so it is not counted twice. The report adds speed, email authentication, broken links, form destinations, domain expiry and search checks.