Free website security check
Enter your domain and get a plain-English report in under a minute. The check looks at what anyone on the internet can see: your connection, security headers, exposed files and your PHP version.
Website security check
We only read what any visitor can see: headers, the home page and a few well-known paths.
This check only sees the outside. It cannot judge plugins, passwords or the server itself.
What the scan checks
The scan runs from our server and requests your site the way a browser would. It covers these areas:
| Area | What we look at |
|---|---|
| Connection | HTTPS, the redirect from http to https, and HSTS |
| Security headers | Content-Security-Policy, framing protection (clickjacking), X-Content-Type-Options, Referrer-Policy |
| What your server gives away | Server software and version, PHP version, platform and WordPress version in the page source |
| PHP2Shell | If the PHP version is visible: whether it has the October 2026 patch, or is end of life |
| Exposed files | A public .git folder or .env file, and directory listing on the uploads folder |
| WordPress basics | Login page at the default address, XML-RPC, usernames listed via the REST API, readme.html |
How to read the report
- Problems need action now. A public
.envfile or.gitfolder can leak passwords; no https means forms travel unencrypted. - Worth fixing are weak spots that make an attack easier, such as missing headers or a visible software version. Each is usually a small configuration change.
- In order means we found nothing wrong on that point.
- What we saw is background information, such as the platform or PHP version. It is not a problem in itself.
What an external check cannot see
An external scan only sees the outside of your site. It cannot judge:
- Whether your plugins and themes are up to date, unless they reveal their version.
- Passwords, user accounts and who has admin rights.
- Whether backups exist and can actually be restored.
- Malware that only shows itself to search engines or to some visitors.
- The server itself: operating system, firewall, other sites on the same machine.
For those you need access to the site and the hosting. If you run WordPress, good WordPress maintenance covers most of them.
What to do next
- Fix the problems first. Block public
.gitand.envfiles, turn on https. If secrets were exposed, change every password and key in them. - Check your PHP version. If the report flags PHP2Shell or an end-of-life version, read our guide on how to upgrade PHP safely.
- Add the missing headers. Your host or developer can set them in the server configuration or at a CDN such as Cloudflare.
- Run the check again after the changes to confirm they work.
Most of these findings come from software running on the server: WordPress, plugins, PHP. The sites we build are static, with no code on the server to exploit. If you would rather stop patching, read about our WordPress alternative.
Questions
Is this website security check free?
Yes. You don’t need an account or an email address. Enter a domain and the report appears on the page.
Is it safe to scan my site with this?
Yes. The scan only requests what any visitor can see: the response headers, the home page and a few well-known paths. It does not try to log in, guess passwords or send attack traffic.
My site passed. Does that mean it is secure?
It means the outside looks in order. An external scan cannot see outdated plugins, weak passwords, old backups or the server configuration, so a clean result is a good start rather than a guarantee.
Can I scan a site that is not mine?
The check only reads public information, so technically yes. It is meant for your own site, or a site you look after for a client.
How do I fix what the check found?
Most header and file issues are fixed in the server or hosting configuration, often in a few minutes, so send the report to whoever hosts your site. If you don’t know who that is, send it to us on WhatsApp and we will tell you where to start.
We track current vulnerabilities in PHP, CMSs and hosting in our Security Watchdog. The latest advisory, on PHP2Shell, is in Dutch.
Not sure what the report means?
Send us your domain. We will tell you which points matter and what fixing them involves.