Tools · Security
Security headers.
Enter a website to grade its HTTPS setup and the security headers it sends: the settings that stop clickjacking, injected scripts and downgrade attacks.
Limits: 3 checks a minute and 15 fresh checks a day per visitor. Results are cached for 24 hours, so a site is fetched at most once a day however many people check it. Only public websites on the standard ports can be checked. Addresses that point at private, local or internal networks are refused, including through redirects or DNS tricks. At most 64 KB of each page is read.