Google Safe Browsing
Whether the URL is on Google's malware, phishing or unwanted-software blacklist — the list that triggers the full-page red warning in Chrome and Firefox.
Free tool
Is your website flagged, exposed, or quietly insecure?
Enter an address and get an honest report in about ten seconds: Google's blacklist verdict, HTTPS and header configuration, the software versions your site is advertising, and any injected-script patterns in the HTML.
What it checks
Everything in one pass.
HTTPS and mixed content
Whether the page is served over TLS, and whether anything on it still loads over plain HTTP, which browsers block or downgrade.
Security headers
HSTS, Content-Security-Policy, X-Content-Type-Options and clickjacking protection, with the exact header to add for each one missing.
Exposed software versions
Whether the page announces which CMS and version it runs. That is how automated attacks choose their targets.
Injected code patterns
Obfuscated eval calls, hidden iframes and long encoded payloads — the shapes injected scripts usually take.
Server disclosure
Server and X-Powered-By headers that tell an attacker what you are running before they have tried anything.
Questions
What this tool is, and is not.
- Is this the same as a full malware scan?
- No, and it would be dishonest to imply otherwise. It queries Google Safe Browsing — the blacklist behind Chrome's red warning screen — and scans the page HTML for patterns common in injected code. A server-side infection that never appears in the page source will not show up here. Finding that needs file-level scanning with access to the server.
- My site passed. Does that mean it is definitely clean?
- It means Google has not blacklisted it and nothing obvious is in the HTML. Those are useful signals, not a guarantee. Treat a pass as an absence of known problems rather than proof of health.
- Why does it warn about a missing Content-Security-Policy?
- Because most sites have never set one, and it is the main defence against injected scripts. It is a warning rather than a failure — worth fixing when convenient, not an emergency.
- Do you store the results?
- No. The check runs, the report goes to your browser, and nothing is kept. The only thing stored is a per-IP counter so the tool cannot be abused.
Found something you would rather not fix yourself?
Send the report over. I will tell you what actually matters, what can wait, and what it costs to put right — including when the answer is that it does not need doing.