AltF Security

Website security check

Enter a website address to grade the security headers it sends: HSTS, Content-Security-Policy, clickjacking protection, MIME sniffing, Referrer-Policy, Permissions-Policy, cross-origin headers, cookie flags and version leaks. Every failing check shows the header to add. AltFTool reads the headers only, never the page body, and stores nothing.

  • Free, no sign-up
  • Passwords never leave your browser
  • No fake scans or scores
  • Works on mobile

The headers that matter most

  • Strict-Transport-Security: forces HTTPS for future visits. Use max-age=31536000; includeSubDomains once every subdomain supports HTTPS.
  • Content-Security-Policy: limits where scripts can load from - the strongest defence against cross-site scripting. Start with Report-Only.
  • X-Content-Type-Options: nosniff stops browsers guessing file types.
  • frame-ancestors (or X-Frame-Options): stops other sites framing yours for clickjacking.
  • Referrer-Policy: strict-origin-when-cross-origin avoids leaking full URLs to other sites.
  • Set-Cookie flags: Secure, HttpOnly and SameSite on every session cookie.

How the grade is calculated

Each header has a published weight, with Content-Security-Policy and HSTS weighted highest because they block the most common attacks. Weak values earn partial credit, and version-revealing headers and insecure cookies deduct points. The grade is a summary of configuration, not a measure of whether a site has been breached.

Checking a staging or internal site

The online check refuses private and internal network addresses for safety. For those, run curl -I https://your-site and paste the output into the paste mode - it is analysed entirely in your browser.

Website security check: questions and answers

Is this a vulnerability scanner?

No. It reviews response headers - configuration you can fix in minutes. It does not probe for vulnerabilities, so it is safe to run against any public site.

Why does my site get an F?

Usually because Content-Security-Policy and HSTS are missing, which together carry nearly half the score. Adding nosniff, a Referrer-Policy and frame-ancestors is often enough to reach a C quickly.

Why do results differ from other header checkers?

Each checker weights headers differently and some follow redirects differently. AltF Security grades the final response after up to five redirects and lists the redirect chain.

Is X-XSS-Protection still needed?

No. Modern browsers removed the XSS auditor and the header can introduce issues; set it to 0 or remove it, and rely on Content-Security-Policy.

Does the check store the URL I enter?

No. The request is made, the headers are returned to your browser, and nothing is saved.

Security checks and guides

Full security check-upAll six tools, the tool directory and how each check works.Password leak checkerCheck if your password appears in known data breaches without sending it, plus a strength score and crack-time estimate. Free, private, k-anonymity based.Passphrase generatorGenerate random passphrases and passwords with your browser's secure random number generator. See the entropy of each one. Free, offline-capable, nothing stored.Phishing link checkerCheck a suspicious link for phishing tricks before you click: lookalike domains, fake bank and UPI links, punycode, hidden redirects. The link is never opened.Personal security checkupTake a free 24-point personal security checkup covering passwords, 2FA, devices, scams, privacy and home Wi-Fi. Get a score and your highest-impact next step.Hacked account recoveryYour email, Instagram, WhatsApp or bank account was hacked? Follow these recovery steps in order, secure your email first, and know where to report fraud in India.Data breach responseGot a data breach email or saw your service in the news? Find out what was exposed, which passwords to change, and how to avoid follow-up scams.

88 more free security and privacy tools

Focused tools for one job each, grouped by what you are trying to do. All run in your browser unless the tool says otherwise.

Passwords and sign-in

Create, test and manage the credentials that guard everything else.

Scams and phishing

Spot tricks in messages, links, QR codes and calls before they cost you.

When something goes wrong

Step-by-step help after a hack, a breach, a lost phone or a card fraud.

Devices and home network

Harden phones, computers, routers and smart devices.

See all 88 tools

AltFTool stores no passwords, links or results. Only the website check uses AltFTool's server, to read headers, and it keeps nothing.