It's free, continue with GoogleFree tools · Instant check
Grade my website security
Headers, certificate, email.
Type your website. We grade its security headers with Mozilla’s own HTTP Observatory scoring, check its certificate, and check whether other people can send email that looks like it came from your domain.
Three ordinary page requests and two public DNS questions. Nothing is sent to Mozilla, so the check does not appear in Mozilla’s public scan history.
The free plan
One check is a clue.
The free plan is the whole picture.
- A full audit of up to 50 pages, every week
- The three fixes that win the most enquiries, with the evidence
- Speed, security, AI visibility, tracking and the enquiry path in one report
- Connect Google Analytics, Search Console and Clarity to see what visitors really do
- One website free, or five client sites for an agency. No card.
Questions people ask
Is this the same grade as Mozilla’s Observatory?
It runs Mozilla’s own open-source scoring on the responses we fetch. Two small differences: we do not carry Chrome’s HSTS preload list, and we test CORS with a normal request instead of a preflight.
Does a good grade mean my site is secure?
No. Headers protect visitors from common browser attacks. They say nothing about out-of-date plugins, weak passwords or the server itself. A low grade is still worth fixing because it is usually an hour’s work.
What are SPF and DMARC?
Two DNS records that tell other mail servers which senders are allowed to use your domain. Without them, anyone can send an invoice that looks like it came from you.
More instant checks
Stop guessing.
See what stops visitors enquiring.
Create your free PostCliq account and get your full website audit in minutes.