One address. Two clicks. A clear verdict.
Enter your address. ZwoWebCheck checks reachability, certificate, encryption, security headers and DNS and shows you exactly what to improve.
Free, no sign-up.
Check websites you own or look after. We only fetch what any browser sees. What we fetch
- CertificateValid
- TLSVersion 1.3
- HSTSHTTPS only
- HeadersCSP missing
How it works
Enter the address
Your domain is enough, e.g. your-domain.com – or a specific page with its path.
Wait a moment
We fetch your site the way a browser does and check twelve areas. It usually takes less than half a minute.
Read the result
A traffic light per area, what it means and what you should change – often with ready-made lines for your web server.
What we check
- Reachability
- Whether your address resolves, answers over HTTP and HTTPS and redirects cleanly to HTTPS.
- Certificate & TLS
- Whether the certificate is valid and matches, when it expires and whether outdated protocols are still offered.
- HSTS & headers
- Whether browsers may only connect encrypted and which protective headers your site sends.
- Web server & software
- Which software your site reveals, whether it is up to date and whether actively exploited vulnerabilities affect it.
- DNS
- Name servers, DNSSEC and whether a CAA record defines who may issue certificates for your domain.
- Content & cookies
- Content loaded without encryption, embedded third parties, cookie settings and security.txt.
We only fetch your site the way a browser would – no attacks, no guessed paths. We delete the report after 30 days.
Read first, check later?
- HSTSHSTS tells browsers to reach your website over HTTPS and nothing else. Adding the header takes a minute. Extend it to every subdomain too early, though, and you may lock yourself out of your own test server.
- CSPA Content-Security-Policy tells the browser where your site may load scripts, images and other content from. A script slipped into the page then has nowhere to run.
- Security headersBesides HSTS and CSP, a handful of smaller headers each close one specific gap with a single line of configuration. Others still sit in many templates long after browsers stopped paying attention to them.
- TLS and certificatesThe padlock in the browser says little about how well a connection is actually protected. Behind it sit a certificate that identifies the server and the TLS protocol that encrypts the data, and either can be wrong in ways nobody notices for months.
- CAAAny public certificate authority can issue a certificate for your domain once domain validation succeeds. A CAA record in DNS narrows that down to the authorities you actually use.
- DNSSECDNSSEC signs your domain's DNS answers so that nobody can quietly send your visitors to someone else's server. Switching it on is quick. After that, the DS record at your registrar has to keep matching the zone's key.
- security.txtSomeone who spots a flaw on your website first has to work out who to tell. A short text file in a fixed location answers that question for them, as long as someone keeps it current.