Free tool
Light website security check
Direct answer: Enter your website and run a light public check: homepage HTTPS and security-related headers, robots/sitemap reachability, and whether common sensitive paths (/.env, /.git/config, /wp-admin/, /admin/) respond. After you run, findings are grouped as Pass, Review, and Info, each with what the check means and what the result means. This free tool is not Trendi’s penetration testing product, not enterprise red-team work, and not a promise that your site is hack-proof. For a scoped penetration test quote, see penetration testing.
What we test (before you run)
This free tool is not a penetration test. It is a light public hygiene check — presence/absence only. No exploit payloads, no login attempts, no authenticated testing. Paid penetration testing is a separate scoped service with a written NZD quote.
| Check | What it means | How results are labelled |
|---|---|---|
| Homepage HTTPS | Whether the final homepage URL uses https:// and responds. | Pass if reachable over HTTPS · Review if not |
| Security headers | HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy on the homepage response. Short values shown in full; long CSP can be expanded. | Pass when present · Review for missing HSTS on HTTPS · Info for other missing optional headers |
| Sensitive paths | Whether /.env or /.git/config answer publicly. These must never be on the open web. | Pass if blocked or not found · Review if they respond |
| Common admin paths | Whether /wp-admin/ or /admin/ answer. Often a login page — we do not try passwords. | Pass if not found or auth-blocked · Review if something public answers |
| robots.txt & sitemap.xml | Whether the usual crawl files respond. Useful context, not a vulnerability score. | Info either way for this security tool |
What this does not do
- No exploit payloads, login attempts, or authenticated testing
- Not a PCI, ISO, or insurance compliance audit
- Not a guarantee the site cannot be hacked afterwards
- Not a substitute for penetration testing when you need a scoped engagement
How to use the results
Fix high items first (public /.env or /.git, missing HTTPS). Then review admin surfaces and missing hardening headers with your developer. Re-run this check after changes. For crawl and SEO readiness, use the free site snapshot.
Sources and limits
Checks use ordinary HTTP GET from Trendi’s server (rate-limited). We report status codes and header presence only. Cookie flag notes apply to the homepage response when Set-Cookie is present. We do not store the sites you check beyond what the request needs to return a result.
Updated