Free tool
Website security check
A website security check scans the public side of a site for the weaknesses attackers look for first. Vigilbase's free check runs 28 tests across TLS and SSL, security headers, exposed files, server configuration, common vulnerability signals and operational best practices, then gives a grade and a fix for each finding.
- ISO 27001 compliant
- SOC 2 Type 2 compliant
- Preferred Cloudflare Partner
- 24/7 follow-the-sun support
What the website security check tests
- TLS and SSL: certificate validity, protocol versions and HTTPS redirects.
- Security headers: HSTS, Content-Security-Policy, X-Frame-Options and others browsers rely on.
- Exposure: files and paths that should never be public, such as .git folders, backups and environment files.
- Server configuration: version banners, directory listing and risky HTTP methods.
- Common vulnerability signals and operational best practices such as security.txt.
Is the scan safe for a live site?
Yes. It makes ordinary web requests, the same kind a browser or search crawler makes. It does not try to log in, submit forms or exploit anything.
A check is not a penetration test
An external check finds misconfigurations quickly. It cannot see inside your application or test business logic. Use it to fix the obvious gaps, then keep the site protected with a managed web application firewall and continuous monitoring.
How Vigilbase helps
Vigilbase runs security operations and website protection for businesses that would rather not build a security team.
Vigilbase Shield
Managed Cloudflare WAF, DDoS and bot protection, configured and watched by our team.
Learn moreIncident response
Help to contain, clean up and recover when something has already gone wrong.
Learn moreVigilbase OS
AI investigates every alert and brings you only verified threats, with the fix ready to approve.
Learn moreFrequently asked questions
How often should I check my website's security?
After every significant release or hosting change, and at least monthly. New exposures often come from a deploy that adds a file or drops a header.
What is a good website security grade?
Aim for no failed checks in TLS, exposure and server configuration. Header warnings are common and usually quick to fix.
Why do I need to verify my email?
Verification keeps the free scanner from being used for automated abuse and lets Vigilbase send you the full report.
Is the website security check free?
Yes. It runs on vigilbase.com at no cost.
More free tools and guides
Security handled, around the clock
Vigilbase is ISO 27001 and SOC 2 Type 2 compliant and a Preferred Cloudflare Partner, with follow-the-sun support from teams in Kenya, South Africa, the UAE and Portugal.