Check a website's HTTPS and security headers
check_websiteRead-onlyIdempotent
Loads the homepage of a public website once, the way a visitor's browser would, and reports its HTTPS setup and security headers (HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and others). Returns a score out of 100, a verdict, and each finding with its severity and a plain-English fix. Use it for questions like 'is example.com secure?' or 'what security headers is my site missing?'. It does not log in, submit forms, scan ports or test for vulnerabilities, and it refuses private or internal addresses.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | A public domain or HTTPS address, for example example.com or https://example.com/. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | ||
| score | Yes | ||
| counts | No | ||
| verdict | Yes | ||
| findings | Yes | ||
| final_url | No | ||
| report_url | No | ||
| certificate | No | ||
| http_status | No | ||
| limitations | No |