SiteGrade: Security Check
Check what a site actually serves browsers: security headers, TLS certificate, DNS, HTTPS redirects, and mixed content. Graded A to F, explained in plain English.
What SiteGrade Does
A native Apple app that turns a website's security configuration into a report card you can act on.
A grade that shows its work
Points, caps, and bands come from a rubric published inside the app, so you can always answer "why a B?". Every finding shows the raw evidence behind it: the header value received, the certificate fields, the DNS answers.
Explained, not dumped
Every finding answers three questions: what it means, why it matters, and how to fix it, with copy-ready nginx and Apache values and a command to confirm the fix landed. There is also a fix prompt written from your own report that you can hand to a coding agent.
Check from anywhere you browse
Type a domain on iPhone, iPad, or Mac, or share a page straight from Safari, and the answer takes seconds. The Mac app is native, with a sidebar, real windows, and menu-bar commands.
History and comparison
Reports are kept on your device and grouped by domain, so a grade has a trend instead of a moment. Re-check a site and SiteGrade shows what was fixed, what regressed, and what is new.
What It Checks
Every check is passive and read-only, and every result shows the raw evidence behind it.
Security headers
- Content-Security-Policy, including report-only policies
- Strict-Transport-Security, with max-age and includeSubDomains
- X-Content-Type-Options, X-Frame-Options, and CSP frame-ancestors
- Referrer-Policy and Permissions-Policy
- Cross-Origin-Opener, Embedder, and Resource-Policy
- Server and framework version disclosure, and legacy X-XSS-Protection
TLS certificate
- Chain validity, trusted root, self-signed and hostname-mismatch detection
- Expiry date, with a warning well before it becomes an outage
- Negotiated protocol version, TLS 1.0 through TLS 1.3
Transport
- Whether plain HTTP redirects to HTTPS, asked on port 80 directly
- The full redirect chain, including cross-host and downgrading hops
- Mixed content: every insecure subresource request the page makes, active and passive
DNS and email
- A, AAAA, CNAME, and MX records
- SPF and DMARC presence and policy
Reported as information only. DNS and email findings never move the letter grade.
Free and Pro
Checking sites is free and unlimited. Pro is a one-time purchase, never a subscription.
Free
Unlimited- Unlimited checks, on every platform
- The A to F grade for any site you check
- The full list of findings behind that grade
- Bundled example reports, so you can try it before checking a real site
Pro
One-time purchase- Every finding's plain-English explanation, fix snippet, and evidence
- History, kept on your device and grouped by domain
- Compare, so a re-check shows what changed since last time
- Export the full report as Markdown or PDF, plus the fix prompt
- Covers iPhone, iPad, and Mac, and is shareable with your family
Private by Construction
No accounts, no servers, no analytics, no trackers, no ads. Nothing you check is sent to us, because there is nowhere for it to go: SiteGrade has no server component at all. Your reports and history stay on your device, and deleting the app removes them.
The site you check receives a request from your device, exactly as a browser visit would. The mixed-content check loads the page once in an off-screen web view that uses a non-persistent data store, so no cookies, storage, or history survive the check.
Our privacy policy covers SiteGrade in detail, and the terms of service set out how it is meant to be used.
Honest About Scope
A SiteGrade grade reflects the security configuration a site serves to browsers. It is not a security audit. Every check is passive and read-only: a GET request, one TLS handshake, DNS lookups, and one page load, which is the same traffic a browser makes when it opens the page. SiteGrade is built for checking your own site or a site you manage.
SiteGrade Support
Questions, feedback, or trouble with SiteGrade? Send us a message through our contact form and we'll get back to you within a business day.