Why does my site get an F even though it uses HTTPS?

HTTPS is the floor, not the grade. Missing Content-Security-Policy and Strict-Transport-Security alone remove 45 of the 80 header points. Check the header table: each fail row names the header to add. An untrusted certificate also caps the score at 20 regardless of headers.

What is the difference between HSTS and an HTTP to HTTPS redirect?

A redirect fixes the first request after it happens. HSTS tells the browser never to make the plain-http request at all for max-age seconds. The scanner checks both: the redirect is worth 5 points, HSTS 20, and a max-age under 180 days scores half.

Is X-XSS-Protection still needed?

No. Browsers removed the XSS auditor the header controlled, and in some cases it introduced new problems. The scanner flags it as deprecated when set to anything other than 0. Put the effort into a Content-Security-Policy without unsafe-inline scripts instead.

Why are cookies missing from my result?

The table only shows cookies set by Set-Cookie headers on the single first response. Cookies set by JavaScript, by later XHR requests or only after login never reach the scanner. If no Set-Cookie header was present the table is simply omitted.

Does the scanner test for vulnerabilities like SQL injection?

No. It is a configuration check built from three normal requests: the page, an http probe and security.txt. It never sends payloads or guesses paths. For application-level testing you need an authorised penetration test or a dedicated scanner run with the site owner's permission.

What does the mixed content warning mean?

The https page references scripts, images, frames, stylesheets or media over plain http. Browsers block active mixed content such as scripts and may downgrade or warn on images. The findings list up to ten offending URLs. Change each to https or a relative path.

Passive Security Grade

Website Security Scanner

The security scanner fetches a page the way a browser would and grades what comes back: the HTTP security headers, the TLS certificate and protocol, cookie flags, mixed content, whether http redirects to https, and whether the site publishes /.well-known/security.txt. It makes three ordinary requests and sends no payloads, so it is safe to point at any site you are allowed to look at. The result is a letter grade from A+ to F with a fix for every finding.

Loading tool...

Querying live edge resolvers and network infrastructure...

Loading Website Security Scanner...

Querying live edge resolvers and network infrastructure...

How to use the Website Security Scanner

Enter a domain or a full URL such as https://example.com/app and press Scan Website.
Read the grade, the score out of 100 and the pills for TLS, HTTP to HTTPS redirect, security.txt and the HTTP status.
Go through the Security headers table from the top. Failing rows carry the most weight and each row states what to set.
Check the TLS, redirects and content findings, the Certificate card and the Cookies table, then expand Raw response headers if you need the exact values.

What to look for

How the score is weighted

Headers carry 80 points of weight: CSP 25, HSTS 20, X-Frame-Options 10, X-Content-Type-Options 10, Referrer-Policy 10 and Permissions-Policy 5, scaled to 95. Redirecting http to https adds 5. Insecure cookies cost up to 10 and mixed content 5. An untrusted certificate caps the score at 20, no HTTPS at 30.

Grades and the A+ condition

85 or more is an A, 70 a B, 55 a C, 40 a D and anything lower an F. A+ needs a score of at least 95 and a Strict-Transport-Security header that includes the preload directive, which signals the policy is ready for browser preload lists.

A passive scan, by design

The scanner fetches the page over https (falling back to http if that fails), probes http:// for a redirect and requests security.txt. It does not spider, fuzz, brute-force paths or send attack strings, so it cannot find application vulnerabilities, only configuration gaps.

Guide

Reading a security header grade and fixing what it finds

What each header row is checking

Strict-Transport-Security passes with a max-age of 15552000 seconds (180 days) or more and is marked warn below that. The message notes includeSubDomains and preload when present. Content-Security-Policy is the heaviest row: missing is a fail (a report-only policy counts as missing), and a policy that allows 'unsafe-inline' scripts, 'unsafe-eval' or a bare * source passes only partially.

X-Frame-Options passes with DENY or SAMEORIGIN, or when the CSP has a frame-ancestors directive. X-Content-Type-Options needs nosniff. Referrer-Policy is a warn when missing and scores half when set to unsafe-url or no-referrer-when-downgrade, which leak full URLs. Permissions-Policy is a small bonus for restricting camera, geolocation and similar features.

Informational rows that carry no weight

Cross-Origin-Opener-Policy and Cross-Origin-Resource-Policy are reported as present or not set but do not move the score. They are optional hardening. X-XSS-Protection set to anything other than 0 gets a note that the header is deprecated and that CSP has replaced it.

Three rows warn about information leakage rather than protection: a Server header that contains a version number, any X-Powered-By header, and X-AspNet-Version. None of these change the score, but each one tells an attacker which known bugs to try first, and all three are easy to remove in the web server or framework configuration.

TLS, redirects and the certificate card

The first request goes to https. If the certificate is not trusted the finding says why, the score is capped at 20 and browsers would show a warning page. If https fails entirely the scanner falls back to http and caps the score at 30. The negotiated protocol is reported, with TLS 1.0 and 1.1 marked as fail, and a certificate expiring within 14 days gets a warning.

A separate request to http://host/ checks whether the server redirects to https. Yes earns 5 points, no is a warning, and unknown means the http request itself failed. The Certificate card lists protocol, subject, issuer, expiry with days remaining and the trust result, which is enough to spot a missing intermediate or a wrong hostname. For the full extension list paste the certificate into the certificate decoder.

Cookies and mixed content

Every Set-Cookie header on the first response is parsed into the Cookies table with its Secure, HttpOnly and SameSite attributes. A cookie without Secure on an https site, or without HttpOnly, counts as insecure. Each costs 3 points up to a maximum of 10. A missing SameSite is shown as not set (Lax), which is what browsers assume.

On an https page the HTML is scanned for script, img, iframe, link, audio, video and source tags whose src or href starts with http://. Up to ten such URLs are listed under the findings and the page loses 5 points, because browsers block or downgrade those resources and show a broken padlock.

Session cookies need Secure and HttpOnly; add SameSite=Lax or Strict as well
Cookies set by JavaScript or on later requests are not seen by a single fetch
Replace http:// asset URLs with https:// or with relative paths

security.txt and what the scanner cannot see

The third request fetches /.well-known/security.txt and passes if it returns 200 and contains a Contact: line, the minimum RFC 9116 asks for. It is informational: publishing one gives researchers a way to reach you, and the scan's note tells you whether yours is in place.

Because only one page is fetched, headers set on other routes, by edge rules or after login are not graded, and single-page apps that set policies in meta tags may score differently from their live behaviour. The scan is not a penetration test. To check which network ports are open on the same host, use the port scanner.

Knowledge Base & FAQ

Website Security Scanner FAQs

Common questions about the website security scanner.

An A (85 or above) means CSP, HSTS, X-Frame-Options, X-Content-Type-Options and Referrer-Policy are all set sensibly, http redirects to https and cookies carry their flags. A+ additionally needs 95 or more and an HSTS header with preload. A C or D usually means CSP or HSTS is missing.

Related Diagnostic Tools

Combine diagnostics for deep-dive network and DNS troubleshooting.

View All Tools

Safe Port Scanner

Check open, closed, or filtered status across common web, mail, and database TCP ports.

IP & Email Blacklist Checker

Check an IP or domain against Spamhaus, SpamCop, Barracuda and 15+ blocklists.

IP Reputation Checker

Score an IP's reputation from blocklists, proxy/VPN detection and reverse DNS.