← Back to all areas
12% of your overall grade
Security
Whether your site is safe to visit, and whether your email is hard to fake.
Why it matters
Browsers warn visitors away from sites that are not secure, and Google prefers safe sites. We also check that nobody can send fake emails pretending to be your business, a common scam.
What good looks like
- The whole site loads over HTTPS, with a valid certificate
- Visitors who type http:// are moved to the secure version
- Security headers protect visitors from common attacks
- SPF and DMARC stop scammers sending email in your name
What we check
- HTTPS
- HTTP to HTTPS redirect
- SSL certificate expiry
- Mixed content
- HSTS
- Security headers
- SPF and DMARC
- Cookie flags
- Server version exposure
- Server and IP
Check your own website
It's free and takes about 15 seconds.