RUEN
Start a project

Tool

Website security check

Enter an address and we will show which basic browser protections the site turns on and which it does not: security headers, HTTPS, cookie flags, mixed content, software-version disclosure. The check is passive: we read only what the site serves to every visitor.

The check takes up to 20 seconds.

What this check does not do

  • It does not look for vulnerabilities or break into the site. It reads only what the server sends every browser: response headers, cookie flags, page code.
  • It does not guarantee the site is clean. Malicious code on a server is not always visible passively. Google Safe Browsing and Yandex Webmaster show infections — check there too.
  • It does not check internal sections or dashboards — only the public page at the address.

Full check and fix

If something is wrong, we can close it: set security headers, HTTPS and cookies, and find where third-party scripts come from. Describe the task and we will say what and for how much.

Discuss the task

How others do

We measured which protections small-business sites turn on. Most skip even the ones that take a single line.

Read the study (in Russian) →

What we check and why

HTTPS and HSTS
HTTPS encrypts the connection. The HSTS header tells the browser to use HTTPS only, so no one can slip in an unprotected version.
CSP
Content Security Policy: a list of sources a page may load scripts from. The main defence against injected code (XSS), and the one most often missing.
X-Frame-Options
Stops your site being put inside someone else’s iframe — protection against overlaying a fake page on yours.
X-Content-Type-Options
The browser uses the declared file type instead of guessing, so an uploaded image cannot be passed off as a script.
Cookie flags
Secure and HttpOnly: the cookie does not travel over an unprotected connection and is hidden from other scripts. Matters for login cookies.
Mixed content
HTTP files on an HTTPS page: the browser blocks them or warns, and part of the site stops working.
Software version
If the server shows the exact CMS or engine version in its headers, anyone looking for known holes does not have to guess it.