TLS & Security

Shows whether visitors can trust the site connection without certificate warnings or breakage.

Shows whether the server still accepts outdated TLS or SSL versions that should be disabled.

Shows whether browsers are told to stick to HTTPS on future visits.

Shows whether the certificate currently in use appears to be allowed by your CAA policy.

Shows whether the server accepts weak encryption options that should no longer be offered.

Shows whether important cookies are protected with the browser flags expected on a modern site.

Shows whether the browser has clear limits on which code and assets the page may load.

Shows whether you limit which certificate authorities may issue certificates for the domain.

Shows whether the site is exposing browser-readable responses too broadly to other origins.

Checks whether a backup archive is publicly downloadable.

Checks whether a database dump is publicly accessible.

Checks whether docker-compose.yml is publicly accessible.

Checks whether docker-compose.yaml is publicly accessible.

Checks whether macOS Finder metadata is publicly accessible.

Checks whether the .env configuration file is publicly accessible.

Shows whether the deployed site is leaking the Git repository behind it.

Checks whether the .htaccess file is publicly accessible.

Checks whether Subversion metadata is publicly accessible.

Checks whether a backup copy of WordPress configuration is publicly accessible.

Shows whether the page is protected against being embedded for clickjacking abuse.

Checks whether X-Powered-By reveals backend technology or framework details.

Checks whether the Server header reveals exact software version information.

Shows whether browser features are locked down to only what the site truly needs.

Shows whether URL details are being shared onward more than they need to be.

Shows whether browsers are prevented from guessing dangerous file types.

Shows whether security researchers have a clear way to report problems before they become incidents.