Website Security Test

Check your HTTPS setup, security headers, mixed content and cookie flags — the signals browsers and security scanners use to judge whether your site can be trusted.

Free • No Registration • No Login Required

What a Website Security Test Checks

A security test inspects the response your server sends to a normal browser request. It does not attack your site and it does not need access to your code. Everything it reports is visible to anyone who visits, which is exactly why it matters: misconfigured headers and mixed content are public signals that affect user trust, browser warnings and search visibility.

The check covers five areas: whether HTTPS is enforced, which security headers are present, whether the page loads insecure resources, how cookies are scoped, and whether the TLS certificate is valid and correctly chained.

Security Headers Explained

Strict-Transport-Security

Tells browsers to use HTTPS for every future request to your domain. Without it, a single plain-HTTP link can downgrade a returning visitor.

Content-Security-Policy

Limits which scripts, styles, frames and images may load. A restrictive policy is the strongest defence against injected scripts.

X-Frame-Options / frame-ancestors

Stops other sites from embedding your pages in an invisible frame and tricking users into clicking something they did not intend.

X-Content-Type-Options

Prevents browsers from guessing a file's type. Without nosniff, an uploaded file can sometimes be executed as a script.

Referrer-Policy

Controls how much URL information is sent to other sites. strict-origin-when-cross-origin is a sensible default.

Permissions-Policy

Switches off browser features such as camera, microphone and geolocation unless your site actually needs them.

HTTPS, Certificates and Redirects

HTTPS is table stakes. Browsers mark plain HTTP pages as "Not secure", and Chrome no longer autocompletes them. A correct setup does three things: serves every page over HTTPS, redirects HTTP requests to HTTPS with a 301, and uses a valid certificate that covers both the apex domain and the www host. If both versions answer with a 200 response, search engines see two copies of every page.

Check that the certificate chain is complete. A missing intermediate certificate works in some browsers and fails in others, which produces intermittent warnings that are hard to reproduce.

Mixed Content

Mixed content is any resource on an HTTPS page that loads over HTTP: an image, a stylesheet, a font or a script. Browsers block active mixed content such as scripts and iframes outright, and warn about passive mixed content such as images. The usual causes are hard-coded http:// URLs in a template, a CDN that has not been switched to HTTPS, or an old widget pasted into a page years ago.

The fix is to update the URL to HTTPS, or to use a protocol-relative or relative path. Then add upgrade-insecure-requests to your Content-Security-Policy as a safety net for anything you missed.

Cookie Security

  • Secure: the cookie is only sent over HTTPS.
  • HttpOnly: JavaScript cannot read the cookie, which limits the damage from an injected script.
  • SameSite: controls whether the cookie is sent with cross-site requests. Lax is a good default; None requires Secure.

Session cookies without these flags are a common finding, and they are usually a one-line change in your framework or server configuration.

Does Security Affect SEO?

Indirectly, yes. HTTPS is a confirmed lightweight ranking signal, and browser interstitials for insecure pages increase bounce rate. More importantly, a hacked site can be removed from search results entirely, and missing headers make that outcome more likely. Security is not a substitute for content quality, but it protects the traffic you have already earned.

Related Tools