How well is your website defended?
Grade your site’s security headers, HTTPS setup, cookies and the software versions it reveals. You get an instant score and a plain-English fix for every gap.
Passive check: it reads only what your site shows every visitor. No attack traffic.
Get the full report with fix instructions
We’ll email you every finding with the exact setting to change. For privacy, the report goes only to an address at .
Need more than a passive check? An authorized assessment tests logins, forms and the application itself.
Talk to an engineerWhat this checks, and what it doesn’t
This check looks at the defenses anyone can see from the outside: whether the site forces HTTPS, sends the security headers browsers rely on, sets cookies safely, leaks software versions, runs software that is out of date, and publishes a way to report security problems. These are quick to fix and are the first things attackers and cyber insurers look at.
It does not attack your site. Testing for SQL injection, cross-site scripting, directory traversal or weak logins means sending attack traffic, which should only be done with the owner’s written permission. Forte performs those tests as an authorized web application assessment.
Common questions
What are HTTP security headers?
Security headers are instructions a website sends to the browser with every page, such as Strict-Transport-Security, Content-Security-Policy and X-Frame-Options. They tell the browser to always use HTTPS, which scripts may run and whether the page can be framed, which blocks whole classes of attacks like cross-site scripting and clickjacking.
What is a Content Security Policy?
A Content Security Policy (CSP) lists where a page is allowed to load scripts, styles and other content from. If an attacker manages to inject a script into the page, the browser refuses to run it unless it comes from an approved source. It is the main browser-side defense against cross-site scripting (XSS).
Is this a penetration test?
No. This check is passive: it only reads what your site already shows every visitor, such as headers, the certificate and the software versions it announces. It does not send attack traffic, test logins or probe for hidden files. Testing for injection, cross-site scripting or access-control flaws requires an authorized assessment with the site owner’s written permission.
Why does showing software versions matter?
When a server announces exact versions, such as Apache 2.2.15 or PHP 7.4, attackers can look up known exploits for those versions without probing. Hiding version banners and keeping software current removes that shortcut.
Is it safe to run this check on my website?
Yes. It makes the same few requests a normal visitor’s browser would: the home page over HTTPS and HTTP, the public security.txt file and public DNS records.
Also free: Email security check · Cyber insurance readiness check · Forte Managed Security