Free tools · no login

🛡 Website security check

Grade a site A+ to F on HSTS, CSP, clickjacking, cookie flags, TLS versions and leaked server versions, with a fix for each finding.

Security grade F

36/100 · 6 findings · server: cloudflare

https://example.com/ · checked 2026-09-20 01:43 UTC from Vigil's servers

1 high2 medium3 low

Security headers

✕	strict-transport-security HSTS missing	missing
✕	content-security-policy No Content-Security-Policy	missing
✕	x-content-type-options X-Content-Type-Options missing	missing
✕	x-frame-options Clickjacking protection missing	missing
✕	referrer-policy Referrer-Policy missing	missing
✕	permissions-policy Permissions-Policy missing	missing

TLS protocol support

TLS 1.0 · disabledTLS 1.1 · disabledTLS 1.2 · enabledTLS 1.3 · enabled

TLS 1.0 and 1.1 should be off; TLS 1.2 and 1.3 on.

Findings and how to fix them (6)

HSTS missing high

Add 'Strict-Transport-Security: max-age=31536000; includeSubDomains' so browsers never downgrade to http.

No Content-Security-Policy medium

A CSP limits which scripts can run and blunts XSS. Start with 'default-src 'self''.

Clickjacking protection missing medium

Set 'X-Frame-Options: DENY' or a CSP 'frame-ancestors' directive.

X-Content-Type-Options missing low

Set 'X-Content-Type-Options: nosniff' to stop MIME sniffing.

Referrer-Policy missing low

Set 'Referrer-Policy: strict-origin-when-cross-origin' to avoid leaking URLs.

Permissions-Policy missing low

Restrict camera, microphone, geolocation etc. with a Permissions-Policy header.

Share this result:

Run the other free checks on this site:

🔒 SSL certificate check ◉ Uptime & speed check ◎ Domain & DNS check

Watch this automatically

Vigil re-checks every minute and tells you the moment something changes

Uptime checks every minute with latency history, weekly security rescans with an alert when the grade drops, SSL expiry alerts and domain expiry alerts, plus DNS-change detection. Alerts on Telegram, Slack, Discord, email or any webhook.

Monitor this site free

Free plan, no card. Set up in 60 seconds. Start with https://example.com/.