What does your server tell anyone who asks?
Enter your site's address. We open your page like an ordinary browser, probing nothing, and tell you which protections are missing.
A browser requests your page. Your server replies with instructions: what it allows, what it refuses. Watch what's missing, and what a script does with that.
A browser requests your page. The server attaches its instructions.
Two are missing, including the one that says which scripts may run.
An injected script shows up. Nothing stops it.
It runs. One line is enough to read your visitors' session cookie.
You add the two missing headers. They take effect.
The same script comes back, the same way.
The browser checks its origin: not your domain.
It's blocked. The cookie stays out of reach.
What blocks the script takes four lines in your server configuration.
None of these headers is visible on screen. A visitor will never know the protection was missing. Your site may be in this position.
Chrome
Safari
Firefox
Edge
Samsung
Brave
Opera
VivaldiChromeSafariFirefoxEdgeSamsungBraveOperaVivaldiAll these browsers read the same headers to decide what they allow themselves on your page. Whatever you don't declare, each one settles its own way, and rarely yours.
Do you attack my site?
No, and that's deliberate. This tool probes nothing: it tries no hidden addresses, looks for no configuration files, attempts no intrusion. It opens your homepage like any browser and reads what your server volunteers about itself.
What are these headers for?
They're instructions your server gives the visitor's browser. They say which scripts it may run, whether your site can be shown inside a third-party page, whether it must refuse an unencrypted connection. Without them, the browser falls back on its permissive defaults.
What does this check measure?
Thirteen checks grouped into five categories, scored out of 100. The encrypted connection and its certificate, the browser instructions, the cookies, what the page loads, and what the server announces about itself. A check with nothing to examine, a site without cookies for instance, leaves the calculation instead of penalizing you.
Does a good score mean I'm protected?
No. This check looks at the facade. It says nothing about the strength of your code, your passwords, your backups or your admin access. A site perfectly configured on the surface can have a flaw in a form.
Who fixes this, and how fast?
Almost everything is fixed in the server configuration or at your host, often in a few lines. The one exception is the content policy: it requires listing what your pages load, and goes up in stages so nothing breaks.
Scan of example.com
0,0 sYour score is building.
Each category adds the points it earns, and shows the ones you're missing.