WikiAI Security Tools · Free

Free Website Security Checker

Check your website’s HTTPS, certificate, security headers and cookies, and whether your domain is protected from fake emails with SPF, DKIM and DMARC. Every finding explains what we saw and how to fix it.

  • Free, no sign-up
  • Passive and safe
  • Open scoring rules
  • URLs not stored

A passive check, like one normal visit: HTTPS and certificate, security headers, cookies, mixed content and the domain’s SPF, DKIM and DMARC records. No scanning or attack traffic. The address is not stored.

What the Security Checker Looks At

  • HTTPS and certificate

    Whether the page uses HTTPS, whether http:// redirects to https://, when the TLS certificate expires, the TLS version and the HSTS header.

  • Security headers

    Content-Security-Policy, clickjacking protection (X-Frame-Options or frame-ancestors), X-Content-Type-Options, Referrer-Policy, Permissions-Policy and software version leaks.

  • Page and cookies

    Insecure http:// scripts, images and frames on an HTTPS page, the Secure and HttpOnly flags on cookies, and a security.txt contact file.

  • Email and domain

    SPF, DMARC and DKIM records that stop criminals sending email in your name, plus your mail servers and CAA record.

What the Score Means

Each check is worth points by how much it matters: 10 for critical (such as no HTTPS or an expired certificate), 6 for high (such as missing DMARC), 3 for medium and 1 for low. A pass earns all its points, a warning half and an issue none. Informational findings are not scored. It is our checklist of common, visible settings, not a certification that a site is secure.

What It Cannot Check

  • Outdated plugins, themes or server software, unless the site announces its version.
  • Weak passwords, missing multi-factor login or who has admin access.
  • Code flaws such as SQL injection or cross-site scripting: that needs an authorized penetration test.
  • Pages behind a login, other pages on the site, or resources added later by scripts.
  • Whether older TLS versions are still accepted (only the version used with our server is shown).

The Fixes That Matter Most

  • Turn on multi-factor login for your email, hosting and website admin accounts. This tool cannot see it, but it stops most account takeovers.
  • Add DMARC, start with p=none to read reports, then move to quarantine or reject.
  • Force HTTPS with a 301 redirect and an HSTS header.
  • Add the basic security headers in your host or CDN settings: most take one line each.
  • Keep everything updated, from WordPress plugins to server software, and keep a tested backup.

Privacy and Safety

  • Our server makes one normal request to the page, one to its http:// version and one to /.well-known/security.txt, then reads public DNS records.
  • It identifies itself as “WikiAI-SecurityChecker” and sends no cookies or login details. Cookie values are never read or returned.
  • Local, private-network and internal addresses are blocked, every redirect is re-checked, and requests are limited in time, size and number.
  • The checks run in your browser. The address is not logged or saved, and reports you download stay on your device.

Website Security Checker: FAQ

Is this a vulnerability scan or a penetration test?
No. It is a passive check: our server visits the page once, like a normal browser, and reads public DNS records. It does not probe for vulnerabilities, try logins or send attack traffic, so it is safe to run on any site. A full security review or penetration test needs permission and goes much deeper.
Does a high score mean my website is secure?
No. It means the common, visible settings are right. Outdated plugins, weak passwords, server misconfigurations and code flaws cannot be seen from outside without a deeper, authorized review.
Why does it check email records for a website?
Your domain is used for both. Without SPF, DKIM and DMARC, anyone can send fake invoices or password-reset emails that appear to come from your domain. Our SPF, DKIM and DMARC guide explains each record.
Why does it say DKIM was not found when I have DKIM?
DKIM keys are published under a selector name that only your email provider knows. We check ten common selectors. If yours uses another one, open an email you sent, find the DKIM-Signature header and look at the s= value.
Is it safe to run this on a site I do not own?
It only reads what any visitor or mail server can see, so it does not harm the site. Use it to check your own sites or a supplier’s, and get permission before any deeper testing.
Do you store the address I check?
No. The address goes to our server function only for this check and is not logged or saved. Cookie values are never read, only their names and flags. Analytics record that a check ran and a score band, never the URL. See our privacy notice.

Read the full guide:SPF, DKIM and DMARC Explained

More Free AI Tools

Want These Gaps Closed for You?

We review your website, email setup, business accounts and automations, then fix what we find: from DMARC and security headers to multi-factor login and safely stored API keys.

Explore Cybersecurity Services Website SEO Checker