Why use sitechecker
- Twenty-nine passive baseline checks: security headers, TLS, cookies, CMS hints, DNS and mail.
- Plain-language risk notes and copy-paste fixes for nginx and Apache.
- A–F grade with the three highest-impact fixes called out first.
- No account required for a one-off scan.
How it works
- Enter the domain and start the check.
- Workers fetch only with GET/HEAD under SSRF safeguards.
- Review the grade, group summary, and each finding with evidence.
- Copy a fix for your stack and re-check after deploying.
What we look at
The MVP covers level-1 hygiene that any visitor can observe — not penetration testing.
Tips
- Enable HSTS only after HTTPS works on every hostname you serve.
- Start CSP in Report-Only before enforcing.
- Add SPF and DMARC before sending production mail.
Typical uses
- Pre-launch checklist for freelancers and small shops.
- Quick TLS and header sanity check for ops.
- Shareable JSON report for a client hand-off.
FAQ
Does this mean my site is secure?
No. The report is a passive baseline only and never claims the site is safe against attacks.
Do you attack my site?
No. We only send GET and HEAD requests, never forms, logins, or exploit payloads.
How do I opt out?
Publish DNS TXT _sitechecker-optout or mention sitechecker-optout in security.txt, or use the abuse form.
What is checked for free?
Level-1 checks: headers, TLS, cookies, public software hints, DNS/mail, and security.txt.