Free Tools / Website Health Check
Website Health & Security Check
Enter a URL for a plain-English snapshot of your site's health: HTTPS and certificate, security headers, redirects, mixed content, cookie safety, and the SEO basics search engines expect. Every finding comes with how to fix it.
Public sites only. We fetch the page once and read the first part of the HTML. Rate limited.
What it checks
- HTTPS & certificate: whether the site is encrypted, the certificate's expiry, and whether the chain is trusted.
- Redirects: the hops from your URL to the final page, and whether plain http forwards to https.
- Security headers: HSTS, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy.
- Exposure & cookies: server version leakage and whether cookies use Secure/HttpOnly.
- Mixed content: insecure resources loaded on an otherwise secure page.
- SEO basics: title, meta description, mobile viewport, canonical link, robots.txt, and sitemap.
Frequently asked questions
What does a website health check look at?
It checks whether the site loads over HTTPS, the SSL certificate's validity and expiry, the redirect chain, HTTP security headers (HSTS, CSP, and others), mixed content, cookie security flags, server version exposure, and SEO basics such as the page title, meta description, mobile viewport, canonical link, robots.txt, and sitemap.
What are security headers?
Security headers are HTTP response headers that tell the browser how to behave more safely: HSTS forces HTTPS, Content-Security-Policy limits where scripts and content can load from, and headers like X-Content-Type-Options and X-Frame-Options block common attacks. Missing them is a common, easily fixed weakness.
What is mixed content?
Mixed content is when an HTTPS page loads some resources (images, scripts, styles) over plain HTTP. Browsers may block those resources or downgrade the padlock, so the page is not fully secure.
Hardening websites and infrastructure is core to what we do. Talk to us or see our other free tools.