Security headers
HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and the cross-origin policies, each judged on how much it actually protects.
Free website security scan
Website Quickscan
Check the security posture of any public website in seconds. We read the headers your server actually sends, judge how strong they are rather than only whether they exist, and explain every finding in plain language.
Submitted scans are publicly listed on the recent scans page. By scanning, you accept our Terms and Conditions.
Security in depth Plain-language report No sign-up
Most recent scans
www.- Data protection
-
79 - Legal obligations
-
96 - Security
-
56 - Accessibility
-
62 - Quality & technology
-
61 - Trust & transparency
-
100
www.- Data protection
-
85 - Legal obligations
-
72 - Security
-
63 - Accessibility
-
74 - Quality & technology
-
53 - Trust & transparency
-
100
www.- Data protection
-
94 - Legal obligations
-
100 - Security
-
68 - Accessibility
-
49 - Quality & technology
-
71 - Trust & transparency
-
100
meine-mav.- Data protection
-
97 - Legal obligations
-
100 - Security
-
97 - Accessibility
-
87 - Quality & technology
-
86 - Trust & transparency
-
100
schloss-kapfenstein.- Data protection
-
77 - Legal obligations
-
94 - Security
-
66 - Accessibility
-
74 - Quality & technology
-
51 - Trust & transparency
-
100
01 What we check
One thing, checked properly
We deliberately do one thing instead of half of everything: the security surface a visitor can see from outside. Every check is scored on strength, not on presence alone, and a value we cannot read honestly says so instead of guessing.
Content Security Policy
Not just present or absent: we look for unsafe-inline, unsafe-eval, wildcard sources, a missing frame-ancestors, base-uri, form-action or object-src, and whether the policy is enforced at all or only reported.
Transport security
HTTPS redirect, negotiated TLS version and mixed content that quietly loads over plain HTTP.
Mail-domain records
SPF, DMARC and DKIM signals in DNS, which indicate how easily your domain can be used for spoofed mail.
Disclosure contact
A reachable security.txt with a contact and a valid expiry date, so someone who finds a problem knows where to send it.
Third-party code
Foreign scripts loaded without Subresource Integrity, and server software that announces its exact version.
02 How it works
From URL to report in three steps
Drop in a URL
Paste any public web address. No account, no install, nothing to configure.
We scan it headlessly
A real headless browser loads the page while we read its headers, its TLS handshake and its DNS records.
Get a shareable report
Scores, findings and fixes land on a permalink you can send to anyone.
03 Guides
Understand what the scan finds
Our guides explain the accessibility requirements of the German Accessibility Strengthening Act (BFSG) and the technical signals behind your score, in plain language and with concrete next steps.
Is your website affected?
Work out whether the BFSG applies to your website, which exemptions exist and what your next step should be.
BFSG check
The free instant check: test your website against WCAG 2.1 AA in seconds and see where it meets the requirements and where it does not.
Accessibility statement
The mandatory content of an accessibility statement, where it belongs on your site and a template structure you can adapt.
HTTP security headers
What each response header does, which ones your site should send and how to configure them correctly.
Ready to scan your site?
It is free, instant and needs nothing but a web address.