Skip to content
ScanMyPrivacy
Menu

Privacy and leak tests

Full Privacy ScanDNS Leak TestWebRTC Leak TestBrowser Fingerprint TestAm I Using a VPN?HTTP Headers ViewerUser Agent CheckerOpen Port Checker

Online safety assistant

Website Safety CheckerSuspicious Link CheckerScam and Phishing Message CheckerBrowser Security GuideMobile App Safety CheckPersonal Security Checkup

IP and network lookups

IP LookupMy IP LocationWhat Is My Public IP?What Is My IPv6 Address?Reverse DNS LookupDNS Lookup
Online safety Guides API About

Free website security check

Website Safety Checker

Paste a website address to check how well it is secured before you log in or pay. We test the technical basics and tell you what they do not cover.

Check a website

What we test, what we do not, and what we store

Full method →

We test

  • Whether the site uses HTTPS and whether its certificate is trusted and how long it has left
  • Whether plain HTTP redirects to HTTPS and where redirects lead
  • Security headers: HSTS, Content-Security-Policy, nosniff, clickjacking protection, referrer policy
  • Domain age from the public registry record

We do not test

  • Malware or phishing blocklists: a clean result is not a safety guarantee
  • The content of the pages or whether the business is honest
  • Anything on private or internal addresses, which are refused

What we store

  • The address you enter is used for the check and not written to a log or database
  • Short-lived in-memory request counters per network to block abuse
  • Anonymous usage counts only: which tool was completed and a coarse result category, never what you typed, your IP address or your results. Nothing is sent if your browser signals Global Privacy Control or Do Not Track.

Third parties that see data: The site you enter is contacted from our server, so it sees our server's address, not yours. Domain age comes from the public RDAP registry; names are resolved by public DNS resolvers.

What this checker looks at

When you submit an address, our server connects to the site much like a browser would, without downloading its pages, and inspects how it is set up. We look at whether it uses HTTPS, whether the certificate is trusted and how long it has left, whether plain HTTP redirects to the secure version, which security headers it sends, where redirects lead and how old the domain is according to its registry record. Each check is shown as pass, weak or fail with a plain-language reason.

What the checks mean

  • Trusted certificate: your browser would load the site without a warning, and traffic is encrypted.
  • HSTS: the site tells browsers to always use HTTPS, which blocks downgrade attacks.
  • Content Security Policy: limits which scripts may run, the main defence against injected code.
  • Clickjacking protection: stops other sites hiding the page inside a frame to trick clicks.
  • Domain age: very new domains are common in scams, although many honest sites are new too.

What this does not tell you

This is an honest limit, so please read it. A technically tidy site can still be a scam: criminals can get a free certificate in minutes, and a padlock only means the connection is encrypted, not that the owner is trustworthy. We do not check malware or phishing blocklists, and we cannot see the content of the pages. Treat a good result as "well configured", never as "safe to trust". A weak result is not proof of danger either; many legitimate small sites lack some headers.

How to judge a site you do not know

  1. Check the address carefully for look-alike spellings, extra words or an odd ending.
  2. Be suspicious of urgency, unusual payment methods and prices that are too good.
  3. Look for a real company name, address and contact details, and search for independent reviews.
  4. Use a card or payment method with buyer protection rather than a transfer.
  5. Never enter a password reached from an email link; type the address yourself.

Privacy of the check

The request comes from our server, not from your browser, so the site sees our address and not yours. The checker only reaches public websites: it refuses private, internal and reserved addresses, limits redirects and does not read page content. See the privacy policy for what we log.

Last reviewed 2026-10-28. Found a mistake? Report a correction (how we handle them).

Fix it and learn more

How to spot fake login pages and lookalike domainsLearn how to read a web address, catch lookalike domains and fake login pages, and what to do when a page asks for your password after a message or ad.What to do if you clicked a phishing linkClicked a suspicious link or typed a password on a fake page? Follow these steps in order: what to change, check and report, and what can wait.

Also check your…

DNS LookupSee a domain's A, MX, NS, TXT and other DNS records.IP LookupLook up the location, owner and registry record of any IP address or domain.HTTP Headers ViewerThe exact request headers every website receives from you.Full Privacy ScanRun every check at once and get a 0–100 privacy score with fixes.

Frequently asked questions

Does a padlock mean a website is safe?

No. It means the connection is encrypted and the certificate matches the domain. Scam sites can have one too, so judge the site itself as well.

Why does the checker say it cannot reach a site?

The site may be down, may block automated requests or may not offer HTTPS. Private and internal addresses are deliberately refused.

Is a new domain always suspicious?

No. Age is one weak signal. Combine it with the other checks and with what you can verify about the business.

Does this check for viruses or phishing?

No. It checks configuration only. For files use an antivirus scanner, and for suspected phishing report the site to your browser's reporting page.