Run a free 17-category check of a public website. Review security headers, HTTPS, DNS, redirects, SEO basics, accessibility signals, and homepage response details. See what passed, what needs attention, and what could not be tested.
Connect over HTTPS and inspect the homepage response, document tags and selected response headers.
See the check outcome, the observed evidence and the priority of issues found.
Make changes with your website provider, then run another check to see what changed.
A quick visual guide to what WPR checks, what the evidence means, and how to decide what deserves attention first.
Start with the status shown on each finding. Passed means the check was verified. Attention means the evidence points to something worth reviewing. Not Tested means the scanner could not establish a result from the evidence it collected.
Not Tested: This is not a pass or a failure. It tells you that this particular check could not be verified by the current public scan.
WPR checks the public homepage response and the information it makes available. Each finding shows what was observed and, when relevant, what evidence was missing.
Cookie security: If no Set-Cookie response is observed, WPR cannot inspect cookie attributes such as Secure. That does not prove a site's cookies are insecure; it means the homepage response did not provide the evidence needed for that check.
Priority helps organize findings that need attention. It is a guide for deciding what to review first—not a guarantee that every issue has the same impact on every website.
Review higher-priority findings first, then work through medium- and lower-priority recommendations in the context of your website's purpose and configuration.
The diagnostic reviews observable public homepage signals across website delivery, browser security, data configuration, and page experience. Each of the 17 categories groups multiple individual checks. Open a category in your results to review each test's evidence, status, and recommended next step. A check may be marked Not Tested when the response does not provide enough evidence.
These checks do not inspect private accounts, internal application routes, or server-side systems. Review every finding in the context of the website's actual purpose and configuration.
Explore clear answers to common website questions—from troubleshooting pages that will not load to understanding HTTPS and preparing for launch.
Check DNS, redirects, HTTPS, HTTP errors, hosting, and browser issues step by step.
Read the guideLearn what encryption protects, how certificates work, and what the browser's security indicator can and cannot tell you.
Read the guideReview domain setup, redirects, forms, mobile layout, page titles, backups, and measurement.
Read the checklistLearn how HTTPS, HSTS, Content Security Policy, cookie settings, and browser protections work—and why the right configuration depends on the website.
Read the free website security headers guideEnter the public homepage you own or want to check. No installation or payment.
This free tool inspects publicly returned HTTP headers and delivered HTML. Results are limited to that evidence; they are not a penetration test, a guarantee of safety, or a site repair service.
Your 17-category website diagnostic is free. Choose a one-time repair package for supported findings.
Enter your website address in the free diagnostic above before checkout. Checkout opens securely on Stripe.
For a small number of issues you want handled first.
Address a larger group of supported issues in one go.
Handle every eligible repair action identified by your scan.
Repairs are counted by distinct fixes, not simply by the number of “Attention” labels. One fix that resolves multiple findings counts as one repair. “Not Tested” items are not repair items. Issues requiring your hosting provider or a developer may need separate work.
