Fix report

Website Security Report

We check the security configuration anyone can see from outside your website: your certificate, headers, cookies, scripts and public DNS. It is passive: nothing is attacked, no passwords are tried and no hidden paths are probed.

  • Certificate and HTTPS redirect
  • Headers, cookies, mixed content
  • Outdated JavaScript libraries

What we check

  • HTTPS and certificate

    Pages served without HTTPS, whether HTTP redirects to HTTPS, and whether the certificate is trusted, current and using a modern TLS version.

  • Security headers

    HSTS, framing protection, X-Content-Type-Options, Referrer-Policy and Content Security Policy. On Shopify these are managed by the platform and shown for reference.

  • Cookies

    Cookies without the Secure flag and session-like cookies readable by scripts.

  • Mixed content and forms

    Insecure HTTP resources on HTTPS pages, and forms that send data over plain HTTP.

  • Outdated JavaScript

    Versions of jQuery, jQuery UI and Lodash with publicly known vulnerabilities.

  • Disclosure and contact

    Server software versions in headers, and whether you publish a security.txt contact.

  • Email spoofing

    Whether your DMARC policy stops others sending email that looks like it is from you.

What you get

  • Each risk with what it means for your website
  • What you control and what your platform manages
  • Fixes for your server, CDN or platform
  • A ready-made AI prompt for every finding
  • A PDF to share with your developer

How the report is made

  1. 1

    Your pages are loaded in a browser and their headers, cookies and scripts are read.

  2. 2

    Your certificate, HTTP redirect and security.txt are checked from outside.

  3. 3

    Your domain’s DMARC record is read from public DNS.

Findings from the sample report

Real output for Harbor & Pine, a fictional store we built with common problems.

Open the full sample report
  • Problem

    Insecure (HTTP) resources on HTTPS pages

    {n} page(s) load files over plain HTTP.{"n":1}

    Fix: Change the listed addresses to {https} (or upload the files to your store), in the theme or the app that adds them.{"https":"https://"}

  • Problem

    Outdated JavaScript libraries with known vulnerabilities

    jQuery 3.4.1

    Fix: Find which theme file or app loads the library (search the theme code for its file name).

  • Problem

    Cookies without the {flag} flag{"flag":"Secure"}

    hp_session

    Fix: Set the {flag} attribute on these cookies in the app or code that creates them.{"flag":"Secure"}

What it doesn’t cover

  • A penetration test, vulnerability scan or comprehensive security audit
  • Admin, login and checkout security
  • Your server, hosting or app configuration

Questions about this report

Is this a penetration test?

No. It only reads what any visitor’s browser can see. We never attack your site, try passwords or probe hidden paths.

Why do Shopify stores show some items as information?

Shopify sets storefront headers and some cookies itself, and merchants can’t change them. The report shows them for reference and focuses on what you control.

Which libraries are checked?

jQuery, jQuery UI and Lodash, against versions with publicly known vulnerabilities (CVE-listed).

Do you store anything from my site?

Only the results of the checks and screenshots used in your report. See the privacy policy for retention.

Related guides

Other reports

Scan your website today

Find it. Fix it. Verify it.

What kind of website is this?

Your answer picks the right checks, like the shopping journey for online stores. We still check the site's own evidence and show both.

What kind of website is this?

Free scan. No credit card required.