Free tool
Website security check
HTTPS, the certificate, the browser security headers and the cookie flags of any website, read from its front page the way a visitor’s browser reads them.
How do you check if a website is secure?
From outside you can check four things: whether it loads over HTTPS and sends plain HTTP visitors there, whether its certificate is valid and not about to expire, whether it sends the browser’s security headers, and whether its login cookies are protected. This tool checks all four for one address.
What are security headers?
Instructions a site sends with each page telling the browser what to refuse. Strict-Transport-Security keeps visitors on HTTPS, Content-Security-Policy limits which scripts can run, X-Frame-Options stops other sites showing the page in a frame, and X-Content-Type-Options stops the browser guessing what a file is.
Do missing security headers matter when you buy a website?
Less than they look. In our study 111 of 200 Flippa listings were missing at least one, and F(x) rates the gap low: headers are a few lines of server configuration, so ask the seller to add them. A site served without HTTPS, as 113 were, is the larger problem.