Check your website's security basics, free.
A quick, read-only look at a website you own, explained in plain English. Fourteen checks, a traffic light, and what to do about anything worth fixing.
3 free checks a month per account, one per website every 30 days.
Fourteen things, each in one plain sentence.
Security certificate (the padlock)
Is it valid, trusted, and not about to run out?
Encryption strength
Does your site still allow old encryption browsers are dropping?
Sends visitors to the secure version
Does typing your address without https:// still end up on the secure site?
Always use the secure connection (HSTS)
Are browsers told to stay on the secure version?
Content Security Policy
Does your site limit where scripts can load from?
Protection against clickjacking
Can another site show your pages inside a hidden frame?
File type protection
Are browsers told not to guess what kind of file something is?
Referrer policy
How much of your page addresses gets shared with other sites?
Browser feature policy
Are camera, microphone and location switched off where you don't use them?
Cookie settings
Are your homepage's cookies only sent over secure connections?
Software versions on show
Does your site announce exactly which software versions it runs?
Private files left public
Can your source history or a settings file be downloaded?
Security contact file
Do you publish a security.txt so people can report problems to you?
Scripts from other companies
Which outside scripts load on your homepage, and on your checkout page if you tell us where it is.
Three steps, a few minutes.
Sign in
A free account. No card, no credits needed for the health check.
Prove the website is yours
Add one DNS record or upload one file. We only ever check a site its owner has verified.
Get your result
A traffic light and a plain-English line per check, with what to do about anything worth fixing. Switch to the technical view for the exact headers.
It looks. It doesn't touch.
The check sends a handful of ordinary page requests to your site, the same kind a browser makes. It never logs in, never fills in a form and never sends anything designed to break something. It only runs on a website you have proved is yours.
If your homepage answers with an error page instead of your site, the check stops and says so rather than grading the error page, and that website is free to check again once it's fixed.
A health check, not a pentest.
- This was a one-off, read-only look at a few public pages. It did not log in, fill in forms, or try to break anything.
- It does not test for vulnerabilities in your code, plugins or checkout, and it cannot prove your site is secure.
- It does not check your email security, your hosting account, your staff's passwords or your card-payment provider.
- Your site can change tomorrow: one check is a snapshot, not monitoring.
- It is not a PCI ASV scan and does not make you compliant with anything.
Ryvx Compliance is not a PCI Approved Scanning Vendor and does not issue compliance certification.
Want it checked for you, every two weeks?
Ryvx Compliance goes deeper than this free check, runs automatically, and gives you a dated certificate and the policy documents your insurer, bank or card provider asks for. £100/mo or £1,000/yr, one website.