Free Tool

Website Security Check

Check your HTTPS setup, security headers, cookies and security.txt in about 3 seconds. 10 checks, each with what we saw and the exact fix. No signup.

What it checks

  1. HTTPS redirectPlain http:// requests are sent to https://.
  2. HSTSBrowsers are told to never use plain HTTP for your domain.
  3. Content Security PolicyLimits which scripts can run, the main defense against injected code.
  4. ClickjackingOther sites cannot load your pages in a hidden frame.
  5. nosniffBrowsers do not run a file as a script just because it looks like one.
  6. CookiesSecure and SameSite flags on every cookie the homepage sets.
  7. Version disclosureHeaders do not tell attackers which software versions you run.
  8. Referrer-PolicyFull URLs do not leak to every site you link to.
  9. Permissions-PolicyCamera, microphone and location are off unless you use them.
  10. security.txtResearchers know where to report a vulnerability.

The check is passive. It reads the same headers and public files any browser gets, and never probes for hidden files or tries an attack. It covers the basics a browser enforces, not your application code. For AI coding agents and MCP servers, take the AI Agent Security Check.

For agents

The same check is a plain JSON API. No key needed.

GET https://x1y1.co/api/website-security?url=example.com