Free security graders are one of the genuinely good corners of the internet: expert-built, no signup, instant feedback. Here is what each one actually checks, where it stops, and how to assemble them into something like coverage.
Qualys SSL Labs — the TLS deep-dive
The standard for TLS configuration analysis since 2009. Point it at a hostname and it grades the full handshake story: protocol versions, cipher suites, key exchange, certificate chain, known attacks (BEAST, POODLE, ROBOT descendants), HSTS. The letter grade (A+ to F) is widely understood, and the analysis depth is unmatched among free tools.
Limits: HTTPS on port 443 only — nothing about DNS, mail, headers beyond HSTS, or other services. Scans take a few minutes and results are cached; there is no alerting.
securityheaders.com — the header report card
Scott Helme's checker fetches one URL and grades the security response headers: Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and friends. Fast, clear, and the de facto reference for which headers matter.
Limits: headers only, on the exact URL you gave it. It cannot see that your API subdomain sends none of them, and it will not tell you when a deploy quietly drops your CSP.
Mozilla HTTP Observatory — the broad hygiene grade
Mozilla's scanner covers headers plus cookies, redirections, subresource integrity and CORS posture, scored 0–100+ with a letter grade. It is the best single free "how is my web hygiene" number, and the methodology is public.
Limits: web layer only; no TLS depth (it defers to SSL Labs for that), no DNS or email, one host per scan.
MXToolbox — DNS and email records
The long-standing Swiss army knife for DNS: MX, SPF, DKIM, DMARC, blacklist status, and dozens of individual lookups. When you are debugging email authentication, this is where you end up.
Limits: it is a lookup tool, not an assessment — you interpret the records yourself, and the free tier does not watch them for change.
Hardenize — the combined snapshot
Hardenize (from SSL Labs' original author) checks TLS, headers, DNS, email standards and more in one pass — the closest free thing to a full external snapshot, and a good model of what "everything at once" looks like.
Limits: availability of the free service has fluctuated since its acquisition, and continuous monitoring with alerting is the paid product. As ever: a snapshot, on your initiative.
Side by side
| TLS depth | Headers | DNS / email | Ports | History & alerts | |
|---|---|---|---|---|---|
| SSL Labs | Excellent | HSTS only | — | — | — |
| securityheaders.com | — | Excellent | — | — | — |
| Mozilla Observatory | — | Good | — | — | — |
| MXToolbox | — | — | Good (manual) | Some lookups | Paid |
| Hardenize | Good | Good | Good | — | Paid |
The three gaps they all share
- One dimension per tool. A real external review means running four or five of them and mentally merging the results.
- One host at a time. Your grade on
wwwsays nothing about the staging subdomain that certificate transparency logs know about and you forgot. - No memory. The grader does not know what you scored last month, so the most important security question — what changed? — is yours to track in a spreadsheet.
A sensible free workflow: bookmark all five, run them on your main hostnames after significant infrastructure changes, and record the grades somewhere. The moment that ritual stops surviving contact with real work — which for most teams is immediately — that is the job a continuous monitor exists to automate.
Frequently asked questions
What is the best free website security checker?
Use several, because each covers one layer: Qualys SSL Labs for TLS configuration, securityheaders.com for HTTP security headers, Mozilla HTTP Observatory for overall web hygiene, and MXToolbox for DNS and email records (SPF, DKIM, DMARC). Together they give a solid one-time snapshot of a single hostname.
Are free security scanners safe to run on my website?
Yes. These graders are passive: they fetch pages, complete TLS handshakes and query DNS — the same traffic a browser generates. Note that public scanners may cache and display your results, and etiquette (and their terms) says to scan only sites you operate.
Why do I need a paid monitor if these tools are free?
The free tools are checks; a monitor is checking plus remembering plus noticing. It runs every layer together, across all your hostnames including discovered subdomains, keeps history, and alerts you when something changes — an expiring certificate, a dropped header, a new port. If you reliably re-run five graders on every hostname monthly and diff the results, you do not need one. Few teams reliably do.