SiteGrade: Security Check
No in-app products collected for this app.
| Rating | |||
|---|---|---|---|
| St. Lucia | <1%0 | — | |
| Romania | <1%0 | — | |
| Ecuador | <1%0 | — | |
| Estonia | <1%0 | — | |
| Albania | <1%0 | — | |
| Armenia | <1%0 | — | |
| Angola | <1%0 | — | |
| Argentina | <1%0 | — | |
| Austria | <1%0 | — | |
| Australia | <1%0 | — |
Description
SiteGrade checks the security configuration a website serves to browsers, grades it A to F, and explains every finding in plain English with the exact change to make.
Type a domain on iPhone or iPad, or share a page straight from Safari, and the answer takes seconds. One purchase also covers Mac.
WHAT IT CHECKS
Security headers
Content-Security-Policy, including report-only policies
Strict-Transport-Security (HSTS), with max-age and includeSubDomains
X-Content-Type-Options
X-Frame-Options and CSP frame-ancestors
Referrer-Policy
Permissions-Policy
Cross-Origin-Opener-Policy, Cross-Origin-Embedder-Policy and Cross-Origin-Resource-Policy
Server and framework version disclosure
Legacy X-XSS-Protection
TLS/SSL certificate
Chain validity, trusted root, self-signed and hostname-mismatch detection
Expiry date, with a warning well before it becomes an outage
Negotiated protocol version, TLS 1.0 through TLS 1.3
Transport
Whether plain HTTP redirects to HTTPS, asked on port 80 directly
The full redirect chain, including cross-host and downgrading hops
Mixed content: the page loads in an isolated web view and every insecure subresource request is recorded, active and passive
DNS and email
A, AAAA, CNAME and MX records
SPF and DMARC presence and policy
Reported as information only. DNS and email findings never move the letter grade.
EXPLAINED, NOT DUMPED
Every finding answers three questions: what it means, why it matters, and how to fix it, with copy-ready nginx and Apache values and a command to confirm the fix landed. There is also a fix prompt written from your own report that you can hand to a coding agent.
THE GRADE SHOWS ITS WORK
Points, caps and bands come from a rubric published inside the app on a "How grading works" screen, so you can always answer "why a B?". Every finding shows the raw evidence behind it: the header value received, the certificate fields, the DNS answers.
FREE AND PRO
Checking sites is free and unlimited, and every free check shows the grade and the full finding list.
Pro is a one-time purchase, never a subscription. It covers iPhone, iPad and Mac, and it is shareable with your family. Pro unlocks:
Every finding's plain-English explanation, fix snippet and evidence
History, kept on your device and grouped by domain, so a grade has a trend instead of a moment
Compare, so a re-check shows what was fixed, what regressed and what is new
Export of the full report as Markdown or PDF, and the fix prompt
PRIVATE BY CONSTRUCTION
No accounts, no servers, no analytics, no trackers, no ads. Nothing you check is sent to us, because there is nowhere for it to go. Your reports stay on your device.
HONEST ABOUT SCOPE
This grade reflects the security configuration a site serves to browsers. It is not a security audit. Every check is passive and read-only: a GET request, one TLS handshake, DNS lookups and one page load, which is the same traffic a browser makes when it opens the page. SiteGrade is built for checking your own site or a site you manage.
Terms of Use: https://joneslabs.dev/terms