How to Check Website Security Grade?
Questions:
- How do I verify the security level of my website?
- Where can I test my platform security grade?
- How do I use the domain security check tool?
Description:
What you want: To confirm, with your own eyes, that your shop is well protected — and to show a partner or customer that it is.
The 1-minute check
There are free, independent websites that grade how safe any shop is — a bit like a hygiene rating for a restaurant. The best possible grade is A+.
- Open securityheaders.com in your browser.
- Type in your shop's web address (the full secure one, starting with https://).
- Press the scan button and wait a few seconds.
- You should see a big green A+. 🎉
That's it. You can re-run this any time, and you can share the result with partners who ask about your security.
Solution:
If you see a lower gradeDon't worry — it's usually one of a few simple things:
In all of these cases, our support team or your web agency can get you back to A+ quickly.
-
You scanned the wrong address
Make sure you used the secure https:// address, not the old http:// one. Re-scan.
-
A setting was loosened.
If someone previously switched off part of the protection to make a tool work, that can lower the grade. The fix is to put the protection back and instead approve that one tool the safe way (see the other help articles). Your web agency can do this.
-
A delivery network in front of your shop is stripping the protection.
This is technical — hand it to your web agency or our support to check.
Tips and Tricks:
Pro-Tips:
- Want the full picture? For a second opinion, you can also scan at Mozilla Observatory. And to understand why each of these protections matters for your business, see What it does and why you benefit.
Warnings:
-
Ensure you copy the live public URL and not your internal admin dashboard link before running the test.
-
Avoid closing the browser tab while the analysis tool is actively calculating your security grade.
Note for your agency: verify with curl -sI https://domain | grep -iE 'content-security|strict-transport|referrer|permissions-policy|cross-origin'. A grade below A+ usually means unsafe-inline/unsafe-eval crept into script-src, HSTS max-age is too low, or a proxy/CDN is stripping headers. Note: 'unsafe-inline' in style-src is allowed by default for compatibility and does not prevent an overall A+.