Security shouldn't sit behind a paywall.
Security locked behind a paywall or a sales call does nothing for the people who visit your site. So this check is free, needs no account, and nobody calls you afterwards. You get a score that speaks for your visitor, in plain language, with the evidence underneath so you can check it yourself.
No paywall, and nobody calling you afterwards.
Free and anonymous
Nothing to sign up for, nothing to pay. We also don't keep who checked which site. The tool has no stake in your result beyond it being correct.
The score speaks for your visitor
The score weighs what a visitor risks, not how easy or hard it is for you to fix. On a closed platform that can't set a setting, you're exactly as exposed as someone who could and left it. The advice underneath does take your platform into account.
Neutral and checkable
Every verdict follows from public rules and points at the piece it rests on. Your site and a competitor's run through the exact same rules, and you can recalculate the score by hand instead of believing it.
Only what we actually see
Every point deducted maps to something we actually saw. If a check couldn't run, it says not tested and costs nothing. A risk we couldn't measure is not one we make up.
It reads what a security setting actually permits.
A security setting is quick to add, and many checks tick a box the moment they see one. We read what it permits, because that's what decides whether it protects anyone. Like this:
Content-Security-Policy: script-src 'unsafe-inline' https:We only fetch what a visitor gets too
The same page a visitor's browser fetches, and nothing more. We do not hunt for holes or send attack attempts. So it stays a check of your own site.
You get a score you can defend line by line.
Check your site