Free website security checker
Scan a site's security posture in seconds — HTTPS and TLS, the security headers browsers rely on, cookie flags, mixed content, exposed files like .env or .git, and whether it's flagged on Google's blocklist. You get a letter grade and a prioritized list of what to fix, before an attacker finds it first.
What this checks
We inspect response headers (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy), the negotiated TLS version, Secure/HttpOnly cookie flags, http assets on https pages, and probe a small set of sensitive paths (.env, .git, backups, server-status). We also check Google Safe Browsing. Findings are graded critical→info so you know what actually matters.
Why it matters for agencies
A hacked or defaced client site is the fastest way to lose a client — and the blame lands on you. Most breaches start with boring, fixable gaps: a missing header, a leaked .env, an exposed .git folder, an outdated CMS advertising its version. Catching these is cheap; cleaning up a hack is not.
Monitor it continuously
A one-off scan is a snapshot. Sitefolio re-scans every client site on a schedule and alerts you the moment a critical issue appears — a new blocklisting, a freshly-exposed secret — so you fix it before it becomes an incident.
Frequently asked questions
Is this a full penetration test?
No — it's a fast external posture check of the common, high-impact gaps (headers, TLS, exposed files, blocklist). It finds the issues that cause most real incidents, not every possible vulnerability.
Do you try to exploit anything?
Never. We make ordinary GET requests to well-known paths and read response headers — the same information any browser sees. Nothing is exploited or altered.
What's the most dangerous thing you find?
Exposed secrets — a public .env or .git folder leaks database passwords and API keys outright — and a Safe Browsing blocklisting, which usually means the site is already compromised.
Uptime, SSL, domain, performance, SEO and links — with white-label client reports.
Get started free