Free website security checks

Single-purpose checks that answer one question in a few seconds, each with a plain-English explanation and copy-paste fixes for your host. For everything at once, with an AI-written report, run a full audit.

• Hijacked package check Attackers increasingly hijack popular npm packages and publish poisoned versions.
• Security headers check Security headers tell browsers how to protect your visitors: stay on HTTPS, refuse to be framed by other sites, and only run scripts you trust.
• Exposed .env file check A .env file holds your database passwords, API keys and other secrets.
• Exposed .git folder check If your site's .git folder is reachable, anyone can rebuild your entire source code and its history, including any passwords or keys that were ever committed, even ones you later deleted.
• Leaked API key check Anything in your website's HTML or JavaScript is public, including keys a developer meant to keep secret.
• Cookie security check Session cookies are the keys to your users' accounts.
• HTTPS and SSL check An expired or untrusted certificate puts a full-page warning in front of every visitor.

Every check is read-only and safe on a live site. Only check websites you own or are authorized to test.