Enter your website address — we check it for free in 30 seconds and explain the result in plain words.
No need to type http:// or www. Free, no sign-up.
The encrypted connection, the certificate's expiry and settings that protect against attacks.
Whether others can send fake e-mails in your name.
The server's response time, measured from the USA, and the size of the page's HTML. Images and scripts are not timed.
Whether the site looks right on a phone and how it shows up in Google search.
Report: how secure are Azerbaijani websites? Banks, universities, government →
Yes. The check is completely free and needs no sign-up.
Enter your website address in the box above and press “Check”. SaytYoxla checks the HTTPS connection, the SSL certificate, HSTS, CSP and other protective headers, whether the server version is exposed, and mixed (http) content, and explains the fix for every problem in plain words.
After the check, the “Security” section shows how many days the certificate is still valid and its expiry date. When a certificate expires, browsers mark the site as “not secure”, so renew it in time — ideally turn on automatic renewal (for example, Let's Encrypt).
SPF and DMARC are records in your domain's DNS settings. They say which servers may send e-mail in your name. Without them, scammers can write fake e-mails that look like they came from your domain. SaytYoxla checks both; if they are missing, ask your DNS or hosting provider to add them.
The most common reasons: the page title and meta description are missing or weak, the site is not mobile-friendly, or the site was never submitted to Google. SaytYoxla checks the title, the description and mobile-friendliness. A new site should also be added to Google Search Console with a sitemap.
Usually the page has no “viewport” tag, so the phone opens the site at desktop size and shrinks it. SaytYoxla checks this in the “Mobile and Google” section and shows the tag to add.
No. We only look at what is open to everyone: we open the home page, robots.txt and sitemap.xml once and read the certificate and public DNS records. We change nothing and try to break nothing. Exposed files and ports are looked at only in the deep check, after the site's owner has confirmed it.
We do not ask for your name, phone or e-mail, and there are no cookies or tracking scripts. The checked address and its result stay for up to 10 minutes to speed up a repeat check, and your IP address stays for up to 1 day in the counter that limits abuse.
100 is the best result. 90+ is excellent (A), 75+ good (B), 60+ fair (C), 40+ weak (D), below 40 needs serious attention (F). Red problems lower the score the most. Missing basic protection limits the score: no more than 39 without trusted HTTPS, 59 if the certificate expires in under 7 days, 74 with 4–5 basic settings missing and 89 with 2–3 missing.
Show the report to the developer who built your site or to your hosting company — every problem says what to do. If you like, message us on WhatsApp and we will help.