A clearer view of your website
How secure is your website?
Check public protections, review the evidence, and find your next step.
Ready to check
Enter a public website address to start.
Check your website’s public protections.
Super Simple Site Security Check reviews a website’s public pages for connection protections, software warnings and signs of harmful content. Your report explains what needs attention, what to do next and which checks could not be completed.
No outside scan can prove a website is completely safe. This check does not inspect private server files or signed-in areas.
Before you check your website
What is the scanner actually doing behind the scenes?
It requests public pages and files from your website, then examines the returned content and settings. It checks how connections are encrypted and which instructions your site gives browsers to protect visitors.
It also looks for clues identifying software and versions, compares those clues with published security warnings, checks downloaded public files for known harmful-code patterns, and compares website addresses with threat lists.
These checks gather evidence rather than attempt to break into your site. The report distinguishes observed issues, warnings that need confirmation and checks that could not finish.
Does it work with my website platform?
The scanner checks publicly reachable websites, rather than requiring a particular platform. Some checks depend on recognising the software your site uses. If its software or version cannot be identified reliably, the report explains that limitation.
Can it tell me whether my website has been hacked?
It can find some publicly visible signs of harmful content or reported threats, but it cannot rule out a compromise. A report with no detected issues means nothing was found in the checks completed, not that every part of your website is safe.
What does the protection score mean?
The score summarises the public protections and supported software checks assessed during that scan. It is not your chance of being hacked. A score range reflects uncertainty about some settings; unavailable checks are not treated as passes.
What should I do if something needs attention—or could not be checked?
Start with the report’s main concern and suggested next action. A warning does not automatically mean your website is vulnerable. Ask your developer or host to review the evidence. An incomplete check means missing information, not a confirmed website problem.
Can I share the report with my developer?
Yes. Download the complete original report and send it to your developer or host. It includes the findings, evidence and limitations. Reports are accessible through the browser session that created them and retained for up to seven days.
What does a good scan result look like?
A good result shows that the public protections checked are working, with no urgent concerns found in those checks.
For example, you would want to see a protected HTTPS connection, a valid website certificate, appropriate browser protections and no known harmful-code matches in the public files scanned. Software and warning-list checks should show their findings and any limits.
Look beyond the score: check what was tested, what could not be verified and whether anything needs your developer’s attention. A high score with incomplete checks is not an all-clear. Even a good result is a snapshot of public evidence, not a guarantee that the whole website is safe.
Your assessment
Report
Public protection score
This score measures publicly observed protections, not your website’s overall security. Encryption scrambles data during a connection to help keep it private.
Score details and limits
Website settings score:
Protected connections and proof of website identity each contribute 30 points; protection for identified sign-in cookies contributes 20. Cookies are small pieces of browser data that can remember a signed-in visitor. Extra browser rules contribute 20 points: limits on page code 10, keeping future visits encrypted 5, preventing deceptive embedding 3, and treating files correctly 2. If no sign-in cookies are found, their points move to the connection checks. Missing evidence produces a score range. Deeper encryption checks can subtract up to half a point. Verified connection failures, affected software or scam-list entries can limit the score. Suspicious content patterns need investigation and do not automatically lower it. This measures the public checks completed, not the chance of being attacked.
What needs attention
Review the observed settings and qualified warnings below. Published severity describes a warning; it does not establish an attack on this website.
Optional improvements
Additional defenses for your developer to consider after observed issues. Missing one does not prove a security flaw. Together, these settings contribute at most 2 points.
Protections we found
Passing checks cover only the pages and settings tested; they do not prove the entire website is safe.
Is there harmful content or a scam warning?
We check for known harmful code, suspicious page content and warning-list entries. A clear result only covers what we could check.
How does the site protect visitors?
Is the connection securely encrypted?
We check how one publicly reachable server encrypts visitors’ connections. TLS and older SSL are names for connection-encryption methods. These checks can reveal outdated settings. Confirmed weaknesses reduce the score by at most half a point.
What other browser protections are available?
These checks look at privacy, browser-feature access and code loaded from other websites on the first page. They do not change your score.
Which website and services did we reach?
What can search engines discover?
We look at instructions for search engines and lists of public pages. These settings control discovery, not access: they do not keep information private or affect your score.
What people can discover about your site
Public pages can reveal the website-building tool, its add-ons and outside services a site uses. Revealing a name alone is not a security flaw. We do not check domain ownership or personal contact details.