How the free security check works

It is passive

The check makes a handful of normal requests to the site: the home page over HTTPS, the plain HTTP address and a short list of well-known file locations. It does not send attacks, does not crawl the site and does not try to sign in. It is safe to run against your own site or a supplier's.

What it tests

• HTTPS and certificate: whether the site answers securely, whether the certificate is valid and trusted, how long until it expires and whether an outdated protocol version is in use.
• HTTP to HTTPS redirect: whether visitors who type the plain address are sent to the secure one.
• Security headers: Strict-Transport-Security, Content-Security-Policy, clickjacking protection, X-Content-Type-Options, Referrer-Policy and Permissions-Policy.
• Cookies: whether cookies set on the home page carry the Secure and HttpOnly flags.
• Version disclosure: whether the server announces its software version, which helps attackers pick a known weakness.
• Exposed files: whether common sensitive files, such as configuration files and source control folders, can be downloaded by anyone.

How the grade is worked out

Every site starts at 100. Each failed or weak item takes points off, with the most serious problems costing the most. An invalid or expired certificate, or a sensitive file anyone can download, caps the score at 50 whatever else is in place, because either one is serious on its own.

• A (90 and above): strong basics. Keep certificates renewing and review headers when the site changes.
• B (80 to 89): good, with one or two gaps, usually a missing header.
• C (70 to 79): several gaps that are worth fixing soon.
• D (60 to 69): important protections are missing.
• F (below 60): a serious problem, such as a bad certificate, an exposed file or a site that does not load securely. Fix these first.

What a good grade does not tell you

The check looks at the outside of one page. It cannot see weaknesses inside your application, on your servers or in how data is handled. A site can score A and still be vulnerable. Treat the grade as a starting point, not a clean bill of health.

Going further

The free summary lists each item as pass, warning or fail. Step-by-step fixes for each problem are part of the full report, available when you request protection. Sites protected by Guardian also get continuous protection, exposure scans and a monthly report.

What to fix first

If your site has an F or D, start with the item that carries the most weight. In order, that is usually:

• An invalid, untrusted or expired certificate, or a site that does not load over HTTPS.
• Sensitive files that anyone can download. Remove them from the web folder, then check again.
• A missing HTTP to HTTPS redirect and a missing Strict-Transport-Security header.
• A missing Content-Security-Policy and clickjacking protection.
• Cookie flags, version disclosure and the remaining headers.

Running it on many sites

Institutions with many websites, such as a university with department sites or a government body with several portals, can run the check on each one to build a simple list of where to start. Re-run it after each fix to confirm the grade has moved. Results reflect the moment the check ran, so a later change on the site will show up the next time it is checked.

Questions

Is the check free?

Yes. The summary and grade are free for any public website.

Will the check harm or alert my site?

It makes a few ordinary requests, much like a visitor opening the home page. It does not send attacks or crawl the site.

Why did my site get an F when most items passed?

An invalid or expired certificate, or a sensitive file anyone can download, caps the score at 50. Fix that item first and run the check again.

Can I share the result?

Yes. Each result has its own link you can share with your team or your web vendor.