Run a passive security check on any public page. Grades your security headers, cookie flags, HTTPS setup and TLS certificate, then lists exactly what to change and why it matters. No login, nothing installed.
Is this an active penetration test?
No. It is passive. It makes one ordinary GET request, the same request your browser makes when someone visits, and reads the response headers, cookies and TLS certificate. It never injects payloads, guesses passwords or probes hidden paths, so it is safe and legal to run against any site you can visit.
Which checks does it run?
Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options and CSP frame-ancestors, Referrer-Policy, Permissions-Policy, CORS configuration, cookie HttpOnly, Secure and SameSite flags, HTTP to HTTPS redirection, the negotiated TLS version, and how soon the certificate expires.
What does the score mean?
It starts at 100 and subtracts points weighted by severity, so one critical finding costs far more than several low ones. Treat it as a relative measure to improve over time, not an industry-standard rating.
Does a clean result mean the site is secure?
No, and it is important to be clear about this. These are configuration checks on one page. They say nothing about your application logic, authentication, database queries or business rules. A perfect score with a SQL injection flaw behind the login is entirely possible. Use this as a baseline, not as an audit.
Can I scan a site I do not own?
Yes, because every check is passive and equivalent to visiting the page. Active scanning of a site you do not own is a different matter legally, which is why this tool does not do it.
Want this done for your whole site, automatically?
Creative Nexus audits your site, writes the fixes, and keeps you ranking on Google and cited by AI search.