bytereport
English
DeutschEnglish
Log inCreate account
Security

Does your website protect its visitors?

One request to your start page shows whether HTTPS and the certificate are in order, which security headers are missing, which are set wrongly and what your server gives away without need. Every finding comes with the ready-made header line.

The start page is checked. We read the response headers, not the content, and look for a security.txt.

Everything in one report, on a schedule if you like

With an account you check e-mail, security, performance and SEO in one step and get a mail when something changes.

Create account
Start here

The guide to security

What the findings mean and how to fix them, in the same categories as the report. Or straight to a topic:

HTTPS and transportInjection protectionIsolation and privacyCookies and disclosure

What are security headers?

With every answer your web server sends header lines along. Some of them tell the browser what it may allow on your site: only encrypted connections (HSTS), only scripts from known sources (Content-Security-Policy), no embedding in other sites (X-Frame-Options).

If a header is missing, the browser falls back to its default, which is usually generous for the sake of old sites. A header set wrongly is often worse than a missing one, because it pretends to protect.

bytereport fetches your start page, rates the headers in four categories and weighs them by the damage a gap allows. We also look for a security.txt that says where to report a vulnerability. Every finding comes with the line to copy.