Spot configuration issues
Find missing headers or settings that need a closer look with your hosting provider or development team.
Free website security check
Check your website’s security headers and HTTPS
See which security settings your website exposes. Wolf-Agents checks features including CSP, HSTS, HTTPS redirects and the TLS certificate. The results highlight potential issues, explain findings and identify gaps in the measurements.
No installation or Wolf-Agents account is required. The check starts with the address you enter and makes selected additional requests. It does not crawl every page or inspect areas behind a login.
Free report beta: no Wolf-Agents account and no email address required.
Check a website
A+
A
B+
B
C
D
E
F
Best grade within the check scope High risk
What you can do with the result
Prepare informed changes
Read the explanation before changing headers or server settings. A stricter setting still needs to work with your website.
Document the scan
Use the report when you need a record for a handover or your own technical documentation.
What the web check covers
| Area | What the check says |
|---|---|
| HTTP security headers | Features of the retrieved response, including Content-Security-Policy, HSTS and other headers |
| HTTPS and redirects | The externally observed request and redirect path, with selected configuration signals |
| TLS certificate | Visible certificate properties for the checked target |
| Domain DNS and HSTS preload | Selected DNS and preload features; not a complete DNS or infrastructure assessment |
| Delivered HTML | Selected features and references to external resources in the retrieved page |
The check evaluates the response it can reach. Protective systems, redirects and connection problems can limit what it measures.
What this check leaves open
A clean result does not prove that the whole website is secure. The check does not analyse source code or authenticated areas, or actively test for every exploitable vulnerability. Malware, viruses, user permissions, business logic and the complete website are outside its scope.
An unmeasured item is not a passed test. Read the coverage notes as well as the grade.
Understanding security headers
What are security headers, and why do you need them?
Security headers are instructions that the server sends to the browser together with its response. They can switch on protective features and limit how the page behaves. The right configuration depends on your application; a header that is set is not a security guarantee on its own.
Protection against attacks
Transport and isolation
Data protection
CSP Content-Security-Policy Strongly recommended
Defines which resources a page may load and which scripts the browser may execute.
How to put this in context
Where a script injection occurs, a suitably enforced CSP can form an additional barrier. A missing CSP on its own does not prove an exploitable vulnerability.
How the header works
Directives limit script sources and network connections, among other things. How well the policy protects depends on its rules. Report-Only reports violations but does not block them. The underlying application flaw still has to be fixed as well.
HSTS Strict-Transport-Security Important
Tells supporting browsers to access a domain over HTTPS only, for a defined period.
How to put this in context
Without an HSTS rule the browser already knows, or a matching preload entry, a first HTTP request can travel unencrypted before the redirect.
How the header works
The browser remembers the header it received over HTTPS. Further matching HTTP requests are switched to HTTPS locally. includeSubDomains and preload need preparation; a valid certificate is still required.
X-Frame-Options Clickjacking protection Important
Limits whether other sites may embed your website in a frame.
How to put this in context
Where sensitive interfaces can be embedded, third-party pages can lure users into unintended clicks. The actual risk also depends on other protective measures.
How the header works
DENY forbids embedding, SAMEORIGIN allows it only within the same origin. CSP frame-ancestors offers a more flexible alternative. Check intended embeddings before making a change.
X-Content-Type-Options MIME sniffing protection Important
Uses nosniff to limit the browser interpreting certain resource types differently from how they are declared.
How to put this in context
Incorrectly declared resources can be interpreted differently than intended in some contexts. A header does not replace checking uploaded files.
How the header works
nosniff blocks script and stylesheet responses with an unsuitable MIME type in particular. Correct Content-Type declarations and safe upload rules are still necessary.
Referrer-Policy Privacy for visitors Strongly recommended
Controls which URL information the browser passes on as the referrer.
How to put this in context
Depending on the policy and the request, path or query information can be passed on. A missing header does not automatically mean that browsers send the full URL to third-party websites.
How the header works
The policy can limit the referrer to the origin or suppress it entirely. Either way, sensitive data does not belong in URLs. Check the analytics and integration flows you want to keep.
Permissions-Policy Browser API control Recommended
Limits the availability of selected browser features for the page and for embedded content.
How to put this in context
Without an explicit restriction, the defaults of the feature and of the browser apply. A missing policy does not automatically give scripts access to the camera or microphone.
How the header works
The policy can restrict features such as the camera or microphone further. It does not replace the user permission that is required, and it grants no access itself. Support and default settings differ from feature to feature.
COOP Cross-Origin-Opener-Policy Optional
Controls whether a document shares its browsing context with documents connected to it through window relationships.
How to put this in context
Certain relationships between windows can remain in place. That says nothing about whether a third-party tab can read arbitrary data from your website.
How the header works
A suitable COOP policy separates browsing context groups. Together with a matching embedding policy it can enable cross-origin isolation. Check sign-in and payment pop-ups for compatibility in particular.
COEP Cross-Origin-Embedder-Policy Optional
Sets additional requirements for loading resources from other origins.
How to put this in context
Without the matching isolation conditions, certain browser features are unavailable. A missing COEP header does not prove a malware infection.
How the header works
With require-corp, the third-party resources concerned need a matching CORP or CORS approval. The policy does not check how trustworthy their content is. Test the embeddings and third-party resources you need.
You will find concrete setup steps in our web security guides (German). Technical reference: HTTP headers on MDN.
Turn the web results into a report
Use the web report when you need to save, explain or share the scan results. It records the scope, findings and measurement gaps. Read and save the PDF, add your own notes in the DOCX or work with the findings table in CSV.
The available report files are free during the beta, with no email address required. All formats use the same scan; downloading a file does not run another test.
Sending a report by email is optional and unlocks no further content. Save the files you need locally: you can only download them again while the corresponding result is still available.
How to proceed
- Enter the address of a website you are authorised to assess and start the check.
- Read the findings, explanations and any limitations in measurement coverage.
- Save a report if you need one. After making changes, you can run another check yourself and compare the two sets of results.
This does not include ongoing monitoring or an automatically generated before-and-after comparison.
Questions about the website security check
Is this a vulnerability scanner?
It checks selected configuration features visible from outside the system. A comprehensive vulnerability scanner may also actively look for known or exploitable weaknesses. Those broader tests, malware analysis and a full penetration test are not included here.
Can I check CSP and HSTS?
Yes. The tool examines these headers in the response it reaches and assesses selected settings. It does not exercise every application workflow. Test CSP changes with the website functions you actually need.
Does it check every page?
No. It starts with the address you enter and makes the redirect and additional requests required for this check. It does not crawl the entire website.
Does a good grade mean my website is secure?
The grade applies only to this check’s scope. Other areas remain untested, and incorrect findings are possible. Review issues in context. The report may omit an overall grade when the measurements do not support one.
Why might the same server produce different results?
Different URLs, redirects, protective systems or later configuration changes can produce different responses. Compare the target, time and measurement coverage. Downloading the report again does not refresh the scan.
Is the report proof of compliance?
It can contribute technical information to your documentation. It does not certify GDPR, NIS2 or other legal compliance, or replace a complete professional assessment.
How do I act on a finding?
Use its explanation and any available recommendation as a starting point, then check what fits your system. Our web security guides — German provide further technical help. Personal review or implementation work is not included in the free check.