SEO Audit Hub

Website security checker

Check your HTTPS setup, certificate and security headers — and find anything still served insecurely.

  • No sign-up to start
  • 138 checks
  • 500 pages free

Website security checker: what’s checked

Search engines prefer secure sites, and browsers warn visitors away from insecure ones. A correct HTTPS setup is more than a certificate: it includes redirecting insecure requests, sending the headers that tell browsers how to protect your visitors, and not loading scripts or images over plain HTTP.

This checker covers the side of security that affects trust and search: HTTPS, certificates, headers, mixed content and a few outside signals like domain expiry and email authentication. It is not a penetration test.

24 Security A site visitors and search engines can trust starts with a correct HTTPS setup. These checks cover your certificate, transport headers, domain registration and anything served insecurely alongside it.

  • Asks for location on page load

    A location prompt before the visitor has done anything is usually refused and makes the site look untrustworthy. Ask only when the visitor uses a feature that needs it.

    Measured on your homepage with Google PageSpeed Insights.

  • Asks to send notifications on page load

    A notification prompt on arrival is mostly refused, and Chrome now quiets sites that get refused often. Ask after the visitor has shown interest, from a button they press.

    Measured on your homepage with Google PageSpeed Insights.

  • BIMI brand logo for email

    BIMI shows your logo beside your emails in Gmail, Apple Mail and Yahoo, which makes them easier to recognise and harder to fake. It works only once DMARC is enforced (p=quarantine or p=reject): publish a v=BIMI1 TXT record at default._bimi pointing to an SVG logo. Gmail also asks for a Verified Mark Certificate.

  • CORS misconfigured: Allow-Origin * + credentials

    Allow-Origin * combined with credentials exposes user data to any site. Restrict Access-Control-Allow-Origin to trusted origins.

  • Cross-origin scripts without SRI

    Subresource Integrity verifies third-party scripts haven’t been tampered with. Add integrity hashes to cross-origin <script>/<link>.

  • DNS nameserver single point of failure

    If the only nameserver — or one of two — is down or doesn’t resolve, visitors and mail servers can’t find your domain at all. List at least two working nameservers at your registrar; a managed DNS provider gives you several by default.

  • Domain registration expiring

    An expired domain takes your site, your email and every link pointing at it offline on the same day, and desirable names are bought within hours of dropping. Renew it and turn on auto-renew.

  • HTTPS certificate expiring

    When an HTTPS certificate expires, browsers block the page with a full-screen security warning before anyone reaches your site. Renew it, and set up automatic renewal so the deadline never comes round again.

  • Injected spam content (possible hack)

    Gambling, pharma or loan copy the page isn’t about is the usual sign a plugin or theme was hacked — you see your own page, search engines see the spam. View the page source, find where the text comes from (often a plugin, a theme file or the database), remove it, update everything and change passwords, then request a review in Search Console if Google has flagged the site.

  • Missing Content-Security-Policy

    A Content-Security-Policy limits which scripts can run, mitigating XSS. Add a CSP header scoped to your trusted sources.

  • Missing HSTS header

    HSTS forces browsers to use HTTPS, protecting visitors from downgrade attacks. Add a Strict-Transport-Security response header.

  • Missing Permissions-Policy

    A Permissions-Policy limits access to powerful browser features (camera, geolocation). Set one to reduce abuse risk.

  • Missing Referrer-Policy

    A Referrer-Policy controls how much URL data is sent to other sites. Set one (e.g. strict-origin-when-cross-origin).

  • Missing SPF / DMARC

    Without SPF and DMARC, others can spoof email from your domain and your mail may be marked spam. Publish SPF and DMARC DNS records.

  • Missing X-Content-Type-Options

    Without X-Content-Type-Options: nosniff, browsers may MIME-sniff responses into executable content. Add the nosniff header.

  • Missing X-Frame-Options / frame-ancestors

    Without frame protection, your pages can be embedded for clickjacking. Set X-Frame-Options or a CSP frame-ancestors directive.

  • Mixed content (HTTP on HTTPS)

    Loading HTTP resources on an HTTPS page triggers browser security warnings and can break the page. Serve every asset over HTTPS.

  • No CAA record

    A CAA record lists the certificate authorities allowed to issue certificates for your domain, so a certificate from anyone else is refused. Add one naming the CA you use (and any your CDN uses), e.g. 0 issue "letsencrypt.org".

  • No HTTP-to-HTTPS redirect

    If HTTP doesn’t redirect to HTTPS, visitors can land on the insecure version. Add a 301 redirect from http:// to https://.

  • Obsolete TLS version still accepted

    TLS 1.0 and 1.1 were retired in 2020 and no current browser will use them, so leaving them enabled serves no visitor — it only leaves a weaker protocol an attacker can try to force the connection down to, and it fails the security questionnaires clients send. Turn off everything below TLS 1.2 in the server or CDN configuration.

  • Plaintext emails exposed

    Email addresses in plain text get harvested by spam bots. Obfuscate them or use a contact form.

  • Relies on third-party cookies

    Browsers increasingly block third-party cookies, so embeds and tracking that depend on them stop working for many visitors. Check which vendors set them and move to their first-party or cookieless option.

    Measured on your homepage with Google PageSpeed Insights.

  • Server header reveals version

    Exposing server software and version helps attackers target known vulnerabilities. Suppress the Server header version.

  • Vulnerable JS library version

    Outdated JavaScript libraries can carry known security holes. Upgrade to a patched version.

How it works

  1. 1

    Enter your URL

    Paste your homepage. No account, no install, no verification.

  2. 2

    We crawl your site

    The crawler follows your internal links and runs every check against each page it reaches.

  3. 3

    Get your results

    See your score and issue counts at once. A free account shows every finding, page by page, with how to fix it.

Frequently asked questions

Is this a vulnerability scan?

Not in the penetration-testing sense — it never probes your application for exploits. It checks your HTTPS configuration, certificate, headers and mixed content, and flags JavaScript libraries whose version has known vulnerabilities.

Which security headers does it check?

Headers such as HSTS, Content-Security-Policy, X-Content-Type-Options and Referrer-Policy, with what each one does and how to add it.

Do security issues affect my SEO score?

Security has its own score next to the SEO score, so a missing header doesn’t hide your SEO progress — and SEO fixes don’t hide security gaps.

Related free tools

Redirect checker → Follow every redirect on your site to where it really ends — and find the chains and dead ends along the way. Website SEO audit → Crawl your whole site and get a health score, every issue ranked by impact, and a report you can act on — in minutes. WordPress SEO audit → Every technical SEO check, plus the mistakes WordPress in particular makes easy to leave in place.

Ready to check your site?

It takes a couple of minutes and costs nothing.