Check a website

Enter a domain. This reads the site's TLS certificate and security headers from outside, the way a browser would, and says what to fix. It is free and needs no sign-up.

Please scan only sites you run. Nothing here is linked to you. Privacy

What it checks

HTTPS and the redirect from HTTP, the TLS version, the certificate (issuer, days left, name, chain), HSTS, Content-Security-Policy, framing, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, version numbers in Server and X-Powered-By, cookie flags on the front page, when the domain expires, and whether /.env and /.git/HEAD can be read.

What it does not check

It does not scan ports, log in, or look at any page but the front page. It cannot see the server behind the website: its updates, firewall or SSH settings. The certificate cannot be read for sites behind Cloudflare or on TLS 1.3 only, and the results say so. A clean result does not mean a site is secure.

The Stenvakt app checks the server itself, over SSH.