Website security checker.

What this check can and can't see

This is a passive, outside-in check: we load your home page like a visitor and look at what your server sends. It finds missing protections and obvious exposures. It doesn't try to break in, scan for vulnerabilities or test passwords, and a good grade doesn't mean a site can't be hacked. Out-of-date plugins and weak admin passwords are still the most common way small business sites are compromised.

The security headers, explained

• Strict-Transport-Security (HSTS): tells browsers to always use HTTPS, even if someone types http://.
• Content-Security-Policy (CSP): limits which scripts and resources can load, the main defence against injected code.
• X-Frame-Options or frame-ancestors: stops other sites loading yours in a hidden frame to trick clicks.
• X-Content-Type-Options: nosniff: stops browsers guessing file types in a way that can run uploaded files as scripts.
• Referrer-Policy: controls how much of your URL is shared with other sites when visitors click away.
• Permissions-Policy: switches off camera, microphone, location and other features you don't use.

Where to add them

On Apache and most cPanel hosting, headers go in the .htaccess file with "Header always set" lines. On Nginx they go in the server block. Cloudflare can add some through its dashboard or Transform Rules, and WordPress security plugins can add the simpler ones. Start with HSTS, nosniff, Referrer-Policy and X-Frame-Options, which rarely break anything. Content-Security-Policy needs testing, because a strict policy can block your own scripts.

Security and SEO

A hacked site often gets spam pages injected, redirects visitors elsewhere or gets flagged with "This site may be hacked" in Google's results, and rankings can take months to recover. Prevention is far cheaper than the clean-up. Our website care plans handle updates and monitoring, and our technical SEO work covers recovery when something has already gone wrong.