Website Safety & Security Checker

Free, no signup. A practical security snapshot from public signals — useful for prioritizing fixes, never a penetration test.

Built by Patrick Stox

Checks run from our server; we fetch the URL you enter and don't keep the results. This fetches a public page and security.txt. The optional Google Web Risk component is a blocklist advisory, not a live malware scan. No certificate-expiry claim is made. Anonymous run-level outcome counters may be used for aggregate research; URLs, domains, IPs, and identifiers are never included, and no statistic is released below 100 runs.

Feedback
Report a bug

Found something broken in Website Safety Checker? Let us know what happened — this goes straight to a private triage queue, not a public list.

What will be sent 
 No tool inputs, uploads, pasted source, complete results, query parameters, or URL fragments are attached automatically. You can edit or remove the selected passage above. Browser and anti-abuse metadata is processed for spam prevention. 
  
 
  
 
 
  
 
 
  
 
Compare up to three URLs
Checks run sequentially and are not cached as a batch. Grades cover the same bounded public signals as the single check.
 
 
Sample report
Illustrative example — deterministic complete public-signal fixture
A
Safety snapshot: 100/100
HTTP 200 · TLS handshake succeeded.
  • Security headers: all scored header rules pass; COEP absence is informational only.
  • Mixed content: no HTTP subresources or insecure form actions in the supplied HTML.
  • security.txt: valid required fields found.
  • Web Risk: not configured, so no malware/blocklist verdict is claimed.
This perfect fixture is intentionally narrow: it demonstrates scoring and is not described as a secure real-world website.
 
 
 
How to use it
  1. Enter the exact public URL and choose Run safety check.
  2. Read the overall letter as a summary of the implemented checks, then inspect the security-header grade and every reason.
  3. Distinguish a configured Web Risk advisory from checks marked not configured or not evaluated.
  4. Validate and prioritize changes with the site's security owner; do not use this report as a penetration-test substitute.
 
 
 
     
     
     
What the results mean
  • A through F maps the numeric score into a summary band; it is not a risk certification.
  • Security header grade comes from explicit pass, warning, error, and informational header rules.
  • Issues to review lists every score reason plus security.txt and mixed-content evidence.
  • Not configured or not evaluated is unavailable evidence, never a clean Web Risk verdict.
 
How it works
The endpoint fetches the public page, selected response headers, security.txt, limited RDAP data, and an optional Google Web Risk advisory. Shared deterministic functions scan bounded raw HTML for insecure subresources and form actions and validate required security.txt fields; the browser grades the returned evidence and combines those bounded signals into a documented score.
 
Features
  • Security-header findings with exact remediation details.
  • Raw-HTML mixed-content and insecure-form checks.
  • security.txt validation and limited RDAP context.
  • Optional Google Web Risk advisory with unavailable states preserved.
  • Evidence-led score with explicit reasons.
  • Sequential comparison of up to three public URLs.
 
Limitations
This is not a penetration test, vulnerability scan, certificate inspector, privacy audit, or live malware analysis. It does not execute JavaScript or inspect every rendered resource, application route, dependency, account control, server port, or security practice. A high score only describes the fetched public signals.
 
Frequently asked questions
Does an A grade mean a website is safe?
No. It means the bounded public checks scored well. The tool does not test application vulnerabilities, authentication, server configuration, malware behavior, social engineering, or data handling.
What does a Google Web Risk result mean?
When configured, it checks whether Google Web Risk returns a matching blocklist advisory. No match is not a live malware scan or a guarantee that a page is harmless.
Why does security.txt affect the score?
A valid security.txt gives researchers a standard way to report vulnerabilities. It is a useful public trust and response-readiness signal, but it does not make the application itself secure.
Can this checker see an expired certificate?
No. It records whether the HTTPS connectionHTTPS is the encrypted version of HTTP — it uses TLS to authenticate the server and protect data in transit between a browser and a website. Google announced it as a lightweight ranking signal in 2014 and today conditionally prefers HTTPS pages as canonical; Chrome marks plain HTTP pages 'Not Secure.' completed, but the Worker interface does not expose certificate expiry, hostname coverage, chain, or cipher details.
What is mixed content?
Mixed contentMixed content is when a page served over HTTPS loads a sub-resource — a script, stylesheet, image, iframe, or similar — over insecure HTTP. Browsers' current taxonomy is upgradable versus blockable; active mixed content (scripts, styles, iframes) is blocked, and passive mixed content (images, audio, video) is warned about or increasingly auto-upgraded, with exceptions like CORS-enabled images and srcset/picture candidates that are blockable, not upgradable. occurs when an HTTPS page references an HTTP subresource or posts a form to HTTP. Those patterns can weaken transport protection and are detected only when visible in the fetched source.
 
People also explore
ToolDomain ReportToolHTTP Header CheckerToolDNS CheckerArticleSEO Due Diligence for M&AArticleSecurity Issues ReportArticleHTTPS for SEO
 
 
 
Feature requests for Website Safety Checker
 

Upvote what you want most. New ideas can be submitted from the floating Feedback menu;
      requests appear here once approved, and the most-wanted rise to the top.

   
Loading…
  
  ➕ Request a feature   
New requests are reviewed before they appear here.
 
     
  
  
 
 
 
 
    
    
 
Common issues & how to fix them
 
     
  •  Error Page is not served over HTTPS Fix: Serve the page and all canonical assets over HTTPS, then redirect HTTP requests directly to the HTTPS URL. 
  •  Error HTTPS page loads an insecure resource Fix: Replace every HTTP subresource with a working HTTPS URL or remove the insecure dependency. 
  •  Error Form submits to an insecure URL Fix: Change the form action to an HTTPS endpoint and confirm no redirect sends submitted data back over HTTP. 
  •  Warning Protective security header is missing Fix: Add the specifically reported protective header at the origin or edge with a policy tested against the site’s required resources. 
  •  Error TLS certificate signal needs attention Fix: Repair or renew the certificate and TLS chain, then confirm the HTTPS handshake succeeds. 
  •  Error Safe URL redirects to an insecure destination Fix: Keep every redirect hop and the final destination on HTTPS. 
    •