Free tool
Website security checker
A website security check looks at how your site presents itself to every visitor and attacker: whether connections are encrypted, which browser protections are switched on, and what the server reveals about itself. These are the configuration basics behind many real-world incidents.
What this checks
- Whether your homepage loads, how fast it responds and how many redirects it takes
- HTTPS availability and HTTP-to-HTTPS redirect
- Certificate details: issuer, days left, and whether it covers your website name
- Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, shown in a header table
- Clickjacking protection (frame-ancestors / X-Frame-Options)
- Cookie Secure, HttpOnly and SameSite flags observed on the homepage (values are never read)
- Mixed content indicators and server version disclosure
How to use it
- Run the check on your main domain.
- Check the availability and certificate boxes first, then open the website findings; each one lists the exact header or setting.
- Apply the suggested value at your host, CDN or web server.
- Rescan to verify.
Methodology and limitations
PixelPrivate performs passive checks against publicly visible configuration only. It does not test for exploitable vulnerabilities, so a clean result is not a guarantee of security. Only the homepage is assessed, so pages with different settings may behave differently. Availability is one measurement from one location, so a failed request is shown as "could not be loaded", never as downtime; continuous uptime monitoring needs a free account. Read the full security methodology.
Key terms
- Security headers — Security headers are HTTP response headers that switch on browser protections, such as forcing HTTPS, restricting script sources, or stopping your pages being framed by other sites..
- Content-Security-Policy (CSP) — Content-Security-Policy is an HTTP header that tells browsers which sources of scripts, styles, images and frames your pages are allowed to use..
- Secure and HttpOnly cookies — The Secure flag keeps a cookie from being sent over unencrypted connections, and HttpOnly stops page scripts from reading it, which protects session cookies from theft..
Frequently asked questions
Does this find hacked websites or malware?
No. This tool reviews configuration. If you suspect a compromise, contact your hosting provider and a professional incident-response service.
Why does it only look at my homepage?
To stay polite and low-impact. PixelPrivate limits requests, response sizes and redirects by design.
Will adding these headers break my site?
Most are safe. Content-Security-Policy is the exception; start in report-only mode and tighten gradually.
Keep this check running automatically
Create a free account to save results, track your score and get alerted when something changes.
Create free accountRelated tools
Related guides
- How to Secure a Business WebsiteThe configuration and maintenance steps that matter most for small-business websites: HTTPS, updates, headers, cookies, admin access and monitoring.
- Website Security Headers ExplainedWhat each important HTTP security header does, the safe value to start with, and how to roll out Content-Security-Policy without breaking your site.