SSL & Security
Web Security Scorecard
Grade a site's security posture
Tool features
9 features
Weighted A–F grade
One score across five categories, weighted so a broken certificate outranks a missing Permissions-Policy.
CSP graded on quality
Detects 'unsafe-inline', 'unsafe-eval', wildcard sources and missing object-src / base-uri — not just whether a policy exists.
Certificate and TLS
Chain trust, hostname match, days to expiry, negotiated version, and whether TLS 1.0/1.1 are still accepted.
Cookie audit
Secure, HttpOnly, SameSite, domain scope and security prefixes. Values are redacted server-side and never returned.
Mixed content scan
Reads the returned HTML for subresources still referenced over plain http://.
Third-party script audit
Finds cross-origin scripts and stylesheets loaded without an integrity hash — the supply-chain gap a CSP source list cannot close.
Scan any page, not just the home page
Paste a full URL to grade /login or /checkout. Cookies are usually only set on a login page, so an origin-only scan has nothing to grade.
Paste-ready server config
Every header-fixable finding assembled into one block for nginx, Apache, Caddy or a Cloudflare Worker — your existing CSP extended, not replaced.
Severity-ranked fixes
Every finding carries the reason it matters and the configuration change that closes it.
What the scorecard grades
A browser defends a site using whatever the server tells it to enforce: the certificate that proves who you are, the policy headers that constrain what the page may load and run, and the cookie attributes that decide who can read a session. Each is checked separately by its own tool. This one grades them together, because an attacker does not pick a category — they use whichever is weakest.
Every check is scored on quality rather than presence. A Content-Security-Policy containing 'unsafe-inline' does not score like a strict one, a max-age of five minutes does not score like a year, and a cookie without Secure fails outright. Checks are weighted, so a certificate that cannot be trusted moves the grade far more than a missing Permissions-Policy.
Transport
HTTPS reachability, certificate trust and expiry, TLS version, and the HTTP redirect.
HSTS
How long, and how widely, the browser is told to enforce HTTPS on its own.
Content security
The CSP directives that decide which scripts may run, plus mixed content.
Cookies
Secure, HttpOnly, SameSite, domain scope and the __Host-/__Secure- prefixes.
Headers & exposure
Clickjacking protection, MIME sniffing, CORS reach, cross-origin isolation and version disclosure.
How to use this tool
1
Enter a domain or page
Type a hostname, e.g.
example.com, or a full URL such as example.com/login to grade one page. Cookies usually only appear on a login page.2
Run the scorecard
The site is fetched over HTTPS and plain HTTP, its certificate is inspected, and the returned HTML is scanned for mixed content.
3
Read the grade
A weighted A–F grade, with a score for each of the five categories and the count of what passed, warned and failed.
4
Work the findings
Findings are ranked by severity, each with the reason it matters and the change that closes it. The Fix it tab assembles every header-based fix into one block for your server.
Related tools
6 tools
Secure Header Checker
Check security headers like CSP, HSTS, X-Frame-Options, and more with security scoring
OCSP Checker
Check SSL certificate revocation status using the Online Certificate Status Protocol (OCSP)
HSTS Checker
Check HTTP Strict Transport Security (HSTS) header configuration and preload status
Cookie Security Checker
Audit every Set-Cookie header a site returns for the Secure, HttpOnly, SameSite, prefix, scope and expiry attributes
SSL Checker
Comprehensive SSL certificate analysis including validity, expiration, chain verification, TLS versions, and security assessment
Mixed Content Checker
Scan any HTTPS page for insecure HTTP resources — scripts, images, styles, and media — that trigger browser security warnings or get silently blocked.
Frequently asked questions
10 Q&A
The Security Headers tool answers one question — which security headers does this URL return — header by header. The Scorecard grades the whole browser-facing surface: the certificate and TLS version, the redirect from HTTP, cookie attributes, mixed content, and the quality of the CSP rather than just its presence.
The Domain Health Report audits an entire domain, including DNS, email authentication, WHOIS registration and blacklist reputation. The Scorecard looks only at what a browser sees when it loads one origin over HTTPS, and goes deeper on that.
Because the policy is graded, not counted. A CSP whose script-src allows 'unsafe-inline' without a nonce or hash permits any injected inline script to run, which is the exact attack a CSP exists to stop. A wildcard or bare https: source has the same effect.
The header is ignored by every current browser, and its 1; mode=block mode introduced a cross-site information leak of its own — which is why browsers removed it. Scoring a site for sending it would reward a liability, so it is reported for reference and excluded from the grade.
No. Cookie names and attributes are analysed on the server and the value is replaced with a placeholder before anything is returned. Values are credentials and never leave the server, exactly as in the Cookie Security Checker.
Cookies are only visible if the page you scanned sets them. A home page often sets none, so there is nothing to grade and the category is excluded from the score rather than being awarded a free pass. Scan the login page directly — enter example.com/login — and the session cookies will be graded.
Yes. Paste a full URL, e.g. example.com/login, and that page is fetched and graded. The certificate, TLS versions, the HTTP-to-HTTPS redirect and the www counterpart are properties of the origin and are still checked at the root — only the document, its headers, its cookies and its subresources come from the page you named.
Every finding that a response header can fix, assembled into one paste-ready block for nginx, Apache, Caddy or a Cloudflare Worker. If you already send a Content-Security-Policy, the generated one is your policy with the missing directives added — nothing already in it is changed. Certificate settings, cookie attributes and subresource hashes are not included, because those are changed in the application or the certificate configuration rather than by sending a header.
Subresource Integrity pins a script to an exact hash, so a compromised CDN cannot swap it. Plenty of legitimate setups cannot use it — a script that is updated continuously has no stable hash — so it is graded as a warning rather than a failure. It still matters: allow-listing a host in your CSP permits whatever that host serves today.