Security Focused check-ups for the areas that matter most.
HTTPS, HSTS, CSP and the other protective headers.
What we check · 9
- ✓
HTTPS
Serve the whole site over HTTPS with a valid certificate.
- ✓
HSTS
Send Strict-Transport-Security to force secure connections.
- ✓
Content Security Policy
Add a Content-Security-Policy header to limit script sources.
- ✓
MIME sniffing protection
Send X-Content-Type-Options: nosniff.
- ✓
Clickjacking protection
Send X-Frame-Options or a CSP frame-ancestors directive.
- ✓
Referrer policy
Send a Referrer-Policy header such as strict-origin-when-cross-origin.
- ✓
Permissions policy
Send a Permissions-Policy header to restrict powerful browser features.
- ✓
Version disclosure
Hide software version numbers from the Server and X-Powered-By headers.
- ✓
Mixed content
Load every sub-resource over HTTPS.
Diagnostic areas
SEO
Titles, meta descriptions, canonical URLs, headings and indexability.
Performance
Real response time, payload weight, compression and caching.
Mobile
Viewport, responsive hints and touch-friendly markup.
Accessibility
Alt text, labels, language, landmarks and heading order.
Links
Internal and external links, plus real broken-link checks.
UX
Navigation, favicon, readability signals and page clarity.
Content
Word count, text ratio, duplication and structured data.