Website security test: SSL, headers and exposed files
Checks SSL, HTTPS redirects, security headers, mixed content and commonly exposed files with non-intrusive requests.
What does the security test check?
It checks the instructions your site gives browsers to protect visitors, and common misconfigurations. No attacks are attempted.
Encryption
Certificate validity and expiry, HTTP→HTTPS redirect and the HSTS header.
Security headers
CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy.
Mixed content
Looks for scripts, styles, images or forms loaded over HTTP on an HTTPS page.
Information exposure
Server version headers and common files such as .env and .git, each checked with one GET and a content signature.
How is the score calculated?
The total is a weighted average of the layers below. Checks within each layer are scored on their own; a critical issue can cap the total.
| Layer | Weight | Measures |
|---|---|---|
| Encryption | %35 | SSL, HTTPS redirect, HSTS |
| Security headers | %30 | Protection instructions for browsers |
| Mixed content | %15 | HTTP resources on HTTPS pages |
| Information exposure | %20 | Version leaks and exposed files |
What this test measures — and what it cannot
The page was requested over HTTPS and HTTP, certificate details were read from the connection and response headers analysed. Six common paths were requested once each; a file counts as exposed only if its content matches the expected signature. Not measured: software vulnerabilities, password strength and hidden server configuration.
This report is an automated first assessment. It does not guarantee appearing in AI assistants or Google; it only shows measurable technical and content signals.
Frequently asked questions
Does the test attack my site?
No. It reads the public page and six common file paths with a single GET each; it never submits forms, logs in or exploits anything. It is not a penetration test.
Puanım yüksekse sitem güvenli mi?
Yüksek puan, temel yapılandırmanın doğru olduğunu gösterir. Eklenti açıkları, zayıf şifreler veya sunucu tarafı hatalar bu testle ölçülemez; düzenli güncelleme ve yedekleme yine gereklidir.