Website Security Grader
Enter any domain and get an instant A+ to F grade on SSL/TLS, HTTP security headers, exposed sensitive files and email authentication (SPF/DMARC) — with the exact fix for every issue. Passive checks only, nothing is stored.
Passive checks only — the same requests a browser makes. Scan only domains you own or are authorized to assess.
How the security grade works
What does the website security grader check?
Four things, all from the outside: (1) SSL/TLS — whether your certificate is valid and not about to expire, and whether deprecated TLS 1.0/1.1 are still accepted; (2) HTTP security headers — HSTS, Content-Security-Policy, clickjacking protection, X-Content-Type-Options, Referrer-Policy and cookie flags; (3) exposed sensitive files — ten well-known risky paths such as /.git/HEAD, /.env and database backups; and (4) email authentication — SPF and DMARC. Each issue lowers a 100-point score, which maps to a letter grade.
Is it safe to scan a domain I don’t own?
The grader only does what any browser or search crawler does: it loads your homepage, makes a handful of requests for well-known file paths, performs TLS handshakes and reads public DNS records. It never logs in, never sends exploit payloads and never changes anything. If a sensitive file is exposed, the response is checked for a signature and immediately discarded — the contents are never stored or shown. Even so, scan only domains you own or are authorized to assess.
How is the A+ to F grade calculated?
Every domain starts at 100 points. Missing or weak controls deduct points in proportion to their risk — for example an exposed .env or .git directory is −30, missing HSTS −10, missing CSP −10, no DMARC −8. 95+ is A+, 90+ A, 80+ B, 70+ C, 60+ D and anything lower is F. An exposed secret or repository caps the grade at D, however good the rest looks.
My site is behind Cloudflare/CloudFront — why am I missing headers?
Static hosts and CDNs do not add security headers by default. On CloudFront add a Response Headers Policy; on Cloudflare use Transform Rules or a Worker; on Netlify/Vercel set headers in the platform config. Each result below includes the exact header value to add.
Does a good grade mean my site is secure?
No. The grade measures externally visible hygiene — the easy wins attackers and automated scanners look for first. It does not test your application logic, authentication or authorization. For continuous monitoring of your whole external attack surface, and for mapping findings to SOC 2 and ISO 27001 controls, use CATAAM’s attack surface management.
Do you store the domains I scan?
Results are cached briefly (a few hours) to protect sites from repeated scans, and the request is rate-limited per network. We do not require an email address and do not publish individual results.