Check your website's security
Enter an address. Wsec reads the site's certificate, headers, cookies and DNS records, then gives you a short list of fixes you can paste into your server configuration.
Have code, not a live site?
Drop a folder or a .zip. Wsec looks for hard-coded secrets, injection and XSS patterns, and risky settings. Your code is not stored.
Does your firewall block scanners?
Allow Wsec's fixed IP addresses and get ready-made rules for nginx, Cloudflare, fail2ban and more.
What you get
| Feature | What it does |
|---|---|
| 29 website checks | HTTPS, redirects, certificate, TLS versions, security headers, cookies, CORS, mixed content, SPF, DMARC, CAA and security.txt. |
| Fixes you can paste | Each problem comes with the setting to change. Download all header fixes as one nginx, Apache or Express file. |
| Scanner whitelist | Fixed IP addresses and a user agent, so your firewall lets the scan through. |
| Source code check | 63 rules across JavaScript, Python, PHP, HTML and config files. Nothing is kept. |
| Score and history | A grade out of 100, and the change since your last scan of the same site. |
See every check and why it matters
Questions
How does a scan work?
- Wsec looks up the host name and refuses anything that points at a private network.
- It loads the home page over HTTPS, falling back to HTTP, and reads the headers and cookies.
- At the same time it opens a TLS connection, makes one request to port 80, reads DNS records, and looks for
/.well-known/security.txt. - Each check is scored, and the report lists the fix for every problem.
What does Wsec look at?
- Transport
- HTTPS, the redirect from HTTP, certificate validity and key size, and whether TLS 1.0 and 1.1 are still accepted.
- Headers
- HSTS, Content-Security-Policy, X-Content-Type-Options, clickjacking protection, Referrer-Policy, Permissions-Policy, CORS, and version numbers in the Server header.
- Cookies and content
- Secure, HttpOnly and SameSite flags, mixed content, third-party scripts without integrity hashes, and password forms.
- DNS and mail
- SPF, DMARC, CAA and security.txt.
- Exposure (deep scan only)
- Exposed Git folders, environment files, backups, debug pages, directory listings and risky HTTP methods.
My firewall blocked the scan. What now?
Bot filters and web application firewalls often block scanners they have not seen before. When that happens Wsec says so instead of grading the firewall's error page. Add the scanner addresses to your allow list and scan again. The whitelist page has the addresses and the rules.
Can I scan any website?
No. Scan only sites you own or have written permission to test. Scanning someone else's site without permission can be illegal. Only public sites can be scanned, and Wsec refuses private and internal addresses. Site owners can ask to be excluded; see the Acceptable Use Policy.
What does Wsec send and keep?
A normal scan makes about eight read-only requests. Reports are kept for a limited time and then deleted. Uploaded source code is analysed in memory and never stored. Wsec sets no cookies. The Privacy Policy lists every kind of data and how long it is kept.