Security check for websites
How secure is your website?
Trayyce checks your website's TLS, security headers, DNS and email. You get a grade from A+ to F and, for every finding, what you can do.
Start with your website.
Free · no account needed- SSL / TLS
- Security headers
- DNS
- Email security
After the check
Every check ends with a report. What comes next depends on the grade.
- 01
Report
A grade from A+ to F, and every finding with an explanation and a fix. The report stays available at its link for 30 days.
Check a website - 02
Ranking
If the check produces a grade, the website is added to the public ranking with the grade of its home page; subdomains and websites that redirect to another domain are excluded. There you can compare hosting providers, developers and agencies by the security of their own website.
View the ranking - 03
Badge or fixes
From grade B upwards the report offers you a badge with the audit date for your website. Below that, fix the findings first, yourself or with ddevelopment, the developer behind Trayyce.
Badges & pricing
Tools after your first check
For your own domains, ongoing monitoring and agencies. We currently set up accounts and activations on request.
Your domains
Verify ownership and manage your audit reports.
Learn moreVerification badges
A monitored status or a fixed, dated audit snapshot.
Learn moreMonitoring
Track changes and manage notifications.
Learn moreFor agencies
Branded reports and a contact widget for your website.
Learn moreHosting scores
Hosting networks by the grades of the websites they serve.
Learn moreData traces
Your findings, requests and deadlines in one place.
Learn moreAlready have an account? Open workspace
What is checked
Trayyce fetches the address once, follows its redirects if you want, and evaluates the last response. A few targeted requests come on top; the frequently asked questions describe them.
- Headers
- The six core headers
Content-Security-Policy,Strict-Transport-Security,X-Frame-Options,X-Content-Type-Options,Referrer-PolicyandPermissions-Policy, including their values. Also headers sent twice, deprecated headers, CORS and the isolation headers COOP, COEP and CORP. - Content Security Policy
- Every directive of the policy:
'unsafe-inline'and'unsafe-eval', wildcards such as*andhttps:, nonce, hash and'strict-dynamic', missingobject-src,base-uri,frame-ancestorsandform-action. A policy sent only as report-only or only in the HTML head is recognised. - Transport and TLS
- Whether http redirects to https right away, HSTS with its lifetime,
includeSubDomainsandpreload, which TLS versions the server offers, and the certificate with names, issuer, validity and key length. - Cookies
Secure,HttpOnlyandSameSiteof every cookie and the rules of the__Host-and__Secure-prefixes. The report does not contain cookie values.- Disclosure
- Headers such as
ServerandX-Powered-Bythat reveal software and version, and PHP versions without security updates. - Page content
- Third-party scripts without integrity check (SRI), scripts, styles and images over http, forms posting to http addresses, CMS and libraries with their versions.
- DNS
- CAA records and whether DNSSEC is active.
- MX, SPF, DMARC, MTA-STS and TLS reporting of the domain, and the file
/.well-known/security.txt.
We do not check DKIM. Without the selector, which only the sender knows, the key cannot be found.
How we grade
The grade follows a fixed rule, stated here in full. It counts what takes effect in your visitors’ browsers: a header with an ineffective value does not count.
Base grade
We count the six core headers that are present and whose value takes effect.
| effective core headers | 6 | 5 | 4 | 3 | 2 | 1 | 0 |
|---|---|---|---|---|---|---|---|
| Grade | A | B | C | D | E | E | F |
When a core header counts
- Content-Security-Policy
- sent as a header, not only as report-only or in the HTML head, and with
script-srcordefault-src - Strict-Transport-Security
- sent over https with a valid
max-ageabove 0; if sent twice, the first counts - X-Frame-Options
DENYorSAMEORIGIN, or the CSP setsframe-ancestors- X-Content-Type-Options
- the first value is
nosniff - Referrer-Policy
- the last valid value is not
unsafe-url - Permissions-Policy
- readable in the form
feature=(list)
A+
A+ requires base grade A and no finding rated warning or critical in headers, CSP, transport and cookies.
Caps
Some flaws limit the grade no matter how many headers take effect. If several apply, the lowest grade wins.
| Flaw | at most |
|---|---|
| The page is not served over https. | F |
| The certificate is invalid: expired, issued for another name or not trusted. | F |
| Scripts, stylesheets or frames are loaded over http. | C |
| A form submits to an http address. | C |
| The server offers TLS 1.0 or 1.1. | B |
| http does not redirect to https right away. | B |
A CSP sent only as Content-Security-Policy-Report-Only does not count for the base grade.
What does not change the grade
DNS and email, revealed version numbers and the page content appear in the report but do not affect the grade. The two caps for content over http are the exception.
A certificate counts as invalid if its chain cannot be verified against the usual root certificates, for example because the server does not send the intermediate certificate. Some browsers fetch it themselves; the checking service does not.
What we store
- The report, for 30 days.
- Anyone with the link can read it. If the check produces a grade, we add the website to the public ranking. Only a report on the home page is linked there. If you checked a subpage, we also check the home page, and your report stays reachable only through its link. Subdomains, checks without following redirects and websites that redirect to another domain are not added. The ranking does not show who ran the check. After 30 days we delete the report.
- Technical key data per address, for 12 months.
- For every checked host we store the grade, hosting provider, CDN, DNS and mail provider, CMS and libraries with versions, and identifiers of the flaws found. We use this to offer site owners help with fixing them. Twelve months after the last check we delete it.
- Usage statistics, for 90 days and 13 months.
- Only the platform operator can see request counts, times and statuses, public checked domain names and filtered B2B search terms. Personal search identifiers from privacy and profile checks are not included. These statistics contain no visitor IP addresses. We delete individual requests after 90 days and daily totals, which have no link to individual visitors, after 13 months.
- No IP address.
- To limit the number of checks per visitor, we derive a key from your IP address with a secret that changes on every restart. Only this key is stored, for 25 hours at most.
- No cookies.
- These pages set no cookie themselves, not even one for the language. The language is part of the address.
You run a domain and want us to store nothing about it? Delete data about your domain
Frequently asked questions
Why does my site not get an A+ although all headers are set?
'unsafe-inline' in the CSP, a cookie without Secure or a short HSTS lifetime. The report states below the grade what prevents the A+.Why does the grade differ from other checking tools?
How often can I check?
Which addresses does Trayyce not check?
What does the checking service do on my server?
/.well-known/security.txt and, if set up, to the MTA-STS policy, plus one request with the made-up origin https://sicherheitscheck.invalid for the CORS test. For the TLS probes it opens individual connections. Its user agent is Trayyce/1 (+https://trayyce.io). It loads no scripts and submits no forms.