Is the website configured the way it should be?

Enter an address. The check follows the redirects, inspects the certificate, grades the security headers, reads the page for SEO and accessibility basics, and looks for robots.txt, a sitemap and security.txt. One request per page, nothing intrusive.

Reading the result

What is checked, and why it matters.

Connection

The check fetches the address you enter and follows up to six redirects, recording each one. It then tests whether the plain http:// version redirects to HTTPS, because a site that serves content on port 80 lets any network in between read or alter it. The certificate is checked for trust, the names it covers and the days until it expires; the negotiated TLS version is reported, with anything below 1.2 flagged.

Security headers

Response headers tell the browser what it may and may not do with your page. The grade weights them by how much they protect:

Content-Security-Policy (25 points): the main defence against injected scripts. A policy that allows 'unsafe-inline' or any origin in script-src scores half.
Strict-Transport-Security (20): tells browsers to use HTTPS only, for at least six months.
Clickjacking protection (15): frame-ancestors in the CSP or X-Frame-Options, so the site cannot be embedded inside a hostile page.
X-Content-Type-Options (10), Referrer-Policy (10), cookie flags (10), Permissions-Policy (5) and Cross-Origin-Opener-Policy (5).

Version numbers in Server or X-Powered-By are noted as information; they do not lower the grade but they tell an attacker what to try.

Page basics

Title and description length, canonical link, mobile viewport, language attribute, heading structure, structured data, Open Graph tags, image alt text and mixed content. These are the checks a search engine and a screen reader make on every page, and they are cheap to get right.

Site files

robots.txt and sitemap.xml guide crawlers; the check reads robots.txt to see whether it references a sitemap or accidentally blocks everything. /.well-known/security.txt tells security researchers who to contact, which is a small signal that someone is responsible for the site.

What it does not do

This is not a vulnerability scan or a performance audit. It sends read-only GET requests to the page, port 80, and three well-known files, and it never follows a redirect to a private address. For performance, use Google's PageSpeed Insights alongside it.

Common questions

My site is on WordPress, Squarespace or Wix. Can I fix the headers?

Usually yes, but where depends on the platform. Managed platforms often set some headers for you and let you add others through a CDN such as Cloudflare in front of the site. On WordPress they are set in the web server or a security plugin. We can advise on the right layer for your setup.

Why is my grade low when the site has HTTPS?

HTTPS encrypts the connection; the headers govern what the browser does with the page once it arrives. Both are needed. A site with a valid certificate and no headers is common and scores a D or F on headers alone.

The check says the certificate is not trusted, but my browser shows a padlock.

The usual cause is a missing intermediate certificate: browsers cache intermediates from other sites and paper over the gap, strict clients do not. Install the full chain from your certificate provider.

Check the domain's email Look up DNS records

Next step

Want the website to do more than pass a check?

Intelligent Web Platforms is the practice of building a site that attracts the right visitors, answers their questions, and connects them into your CRM and operations, on foundations that score an A here.

Discuss Your Platform Intelligent Web Platforms