Free Website
Security Check

The check runs passive, read-only inspections of your site's public surface: TLS configuration and certificate validity, HTTP security headers (Content-Security-Policy, HSTS, X-Frame-Options and others), cookie security flags, redirect behavior, and information the server exposes about itself. It sends the same kind of requests a normal browser does — nothing intrusive.

Yes. Every check is passive and read-only — equivalent to visiting the site in a browser and reading the responses. No exploitation is attempted, no forms are submitted, and no payloads are sent.

Each finding reduces a 0–100 score, weighted by severity: high-severity issues cost the most, informational findings the least. The final score maps to a letter grade — A and B indicate a strong baseline, C and D show meaningful gaps, and F signals critical issues in the site's public configuration.

The free check reads surface signals only — it never interacts with your application logic. A full Penetrify AI pentest actively attempts exploitation: it logs in, tests authentication and session handling, probes for injection (SQLi, XSS), hunts IDOR and broken access control, and chains findings the way a real attacker would. The free check tells you how your site looks from the outside; the pentest tells you what an attacker could actually do.