HTTPS connection
Does the website respond securely and ask browsers to keep using encrypted connections?
MECANIK DEV LABS /SECURITY CHECK 01
Website security scan in under a minute.
Website security scan for small business websites. Check HTTPS, security headers, email records and trackers, then download a PDF with the fixes.
- Public settings only
- No software to install
- No email required
Start with your website.
A free check of your homepage. Results in under a minute.
SCAN IN PROGRESS
Taking a closer look.
Checking your website's public settings…
0Urgent review
0Needs attention
0Needs a closer look
0Passed
A FOCUSED FIRST LOOK
What does a website security scan check?
The scan runs 28 checks on your homepage. It covers HTTPS and redirects, browser security headers, cookies, email and DNS records, third-party scripts, trackers and outdated libraries. Each result says what to fix, what to look at and what we could not check.
Browser protection
Can the site block unwanted scripts, stop other sites framing it and stop browsers guessing file types?
Cookies, trackers and software
We check cookie settings, trackers that load before visitors agree to them, outdated JavaScript libraries and software versions the site gives away.
The checks included in your report
Each result explains what we saw and what to do next. Optional features and cookies we cannot see are never reported as vulnerabilities.
- Encrypted connection
- Redirect plain HTTP to HTTPS
- Keep visitors on HTTPS
- Control what can run
- Protect against deceptive framing
- Stop browsers guessing file types
- Limit information shared with other sites
- Restrict sensitive browser features
- X-Powered-By disclosure
- Server version disclosure
- PHP patch review
- HTTPS-only cookies
- Session cookie script protection
- Cross-site cookie rules
- Cross-origin access
- Browser window isolation
- Resource embedding rules
- Email sender policy (SPF)
- Email spoofing policy (DMARC)
- Certificate authority rules (CAA)
- Signed DNS (DNSSEC)
- Security contact (security.txt)
- Insecure page resources
- Third-party services
- Tracking before consent
- Outdated JavaScript libraries
- Script integrity checks
- Website platform version
MECANIK DEV LABS
Get more from your website security scan
What a website security scan tells you
A website security scan shows the settings your homepage sends to every visitor. We check HTTPS, browser security headers, cookies, email records, trackers and the software the site gives away. Use your website security scan to prepare questions for your developer and to keep a dated record before you change anything.
Read your website security scan results
Your website security scan sorts results into urgent host checks, settings to fix and choices that depend on how your site works. A missing optional header is not a sign of an attack. The site score in a website security scan runs from 0 to 100 and counts passed checks. The colours tell you what to look at first.
Before and after a website security scan
Run a website security scan before you change hosting or security settings, so you have something to compare against. Check payment pages, logins and embedded services before tightening any rules. Afterwards, run a fresh website security scan, compare it with the old report and test the site in a real browser. Keep software updates and account security in your regular maintenance.
Share a website security scan with your developer
A website security scan is easier to act on when the person doing the work can see it. Download the PDF or send the report link to your developer. Each website security scan shows when it was run. The owner of the website can also publish the report after proving they control the site.
BEFORE YOU SCAN
Questions about your website security
Does a website security scan prove my site is secure?
No. It checks a set of public settings. It cannot find every vulnerability, malware, coding flaw or hacked account. A full security audit goes much further.
Will a website security scan affect my website?
Barely. The scan looks up your DNS records, requests the homepage over HTTPS and plain HTTP, follows up to five redirects, reads security.txt and loads the homepage once in a cloud browser. It does not visit other pages, submit forms, log in or try attacks. If your site blocks the scan, you get an incomplete result.
Why is a website security scan limited to two checks a day?
The limit keeps the tool free and avoids sending needless traffic to websites.
What do the website security scan colours mean?
Red means ask your host to check something urgently, such as an old PHP version with a known critical flaw. Orange means a setting needs fixing. Blue means it is worth a closer look. Green means the check passed. Grey means we could not check it. None of these colours means your site has been hacked.
Can a website security scan detect PHP2Shell?
It can flag a PHP version older than the fixed releases. Version headers can be wrong, hidden or changed, and some hosts patch older versions. Ask your host to confirm the installed PHP version and patches. We never send attack requests. A missing PHP header does not mean PHP is absent or patched.
Why does a website security scan flag software headers?
Version details make it easier to find sites running vulnerable software. Remove them where you can. Hiding them does not fix anything, so keep the software itself up to date.
What should I do after a website security scan?
Start with the red items, then go through the orange ones with your developer or host. Test header changes before going live, because strict rules can break payments, forms and embedded content. Download the PDF to share the results. Mecanik Dev can help pick the right fixes and do the work.
Are my website security scan results public?
No. Scans are private. Only the owner of a website can publish its report, after proving they control the site with a DNS record or a file. You can still share a private link or the PDF. No account or email is needed.
Privacy notice
To stop abuse and to answer complaints or legal requests, Mecanik Dev Ltd keeps a record of every scan. It holds the website, the time, the notice version, your IP address, your browser and device details, and your approximate location based on your IP address. We keep these records for 30 days and then delete them. We do not use them for marketing and only share them when the law requires it.
Our hosting and security provider processes your IP address to run the service and the anti-bot check, and keeps its own logs. Agreeing to a scan is not agreeing to marketing. Your browser creates the PDF itself.
For controller contact details, data rights and information about service providers, see our main privacy policy.
If you publish a report, we store the domain, the scan time and the findings for up to 90 days. The public directory shows the latest report for each website. Private scans are never stored there. Earlier public reports stay up until they expire or are removed. Public reports never include visitor IP addresses, browser details, authorisation records or cookie values.
Your theme preference is saved in this browser. The current report is kept in this tab's session storage so switching languages does not require another scan. Clear browser storage to remove these saved preferences and results.
Need help fixing your website?
Send us your report. We can review the findings, make the changes your website needs and check that everything still works.