Check your website's security settings.

What this tool checks

• HTTPS: whether your site opens over a secure connection.
• HTTP redirect: whether visitors on the insecure address are moved to the secure one.
• Security headers: short instructions your site sends to browsers, which help block common attacks. How to add them on Nginx or Apache.
• PHP version: whether your site shows its PHP version, and whether that version still gets security fixes.
• Private files: whether anyone can download your .env file or .git folder, which often hold passwords and your code. How to block them.
• PHP info page: whether anyone can open /phpinfo.php or /info.php, test pages that list your PHP settings and file paths. Delete them when you're done. Our PHP upgrade guide shows a safer way to use one.
• Cookies: whether the cookies your home page sets are marked Secure (only sent over HTTPS), HttpOnly for login cookies (hidden from scripts) and SameSite (not sent along by other sites). We read only the cookie names and settings, never their values.
• Server version: whether your server tells visitors exactly which software it runs. The same guide shows how to hide it.

What this tool doesn't do

It isn't a full security scan. It doesn't look for hacked files, weak passwords or holes in your apps. A good result means these settings look right, not that your site is safe.

For the next steps, read our security checklist for a new PHP server.

How it works

We load your home page much like a browser does, over HTTPS and HTTP, and read the headers it sends back, including the names and settings of any cookies. We also ask for a few files that should never be public (/.env, /.git/HEAD, /phpinfo.php and /info.php) and read only their first 512 bytes to see what they are. We don't try to break in, and we don't test other pages.

We don't save your results. They're kept for up to 10 minutes so repeat checks don't put extra load on the site. Read our privacy policy for more.