Website X-Ray
Website X-Ray is a free website security and fake site checker. Enter a website or paste a link to see whether it looks like the real site, then get a grade for its HTTPS, certificate, security headers and cookies, with plain-English fixes. The page is never opened in your browser.
Try:
How it works: the fake-site checks run in your browser. Catpool’s server follows the link’s redirects and looks up the domain’s age (reading reply headers only), then makes one normal visit to the home page over HTTPS and one over HTTP, and reads only the headers and certificate (cookie names and flags, never their values). Private and internal addresses are refused, results are cached for 10 minutes and checks are limited to a few per visitor. Nothing about you is stored.
How to use it
- Type a website address, such as
example.co.uk, or paste a whole link from a text or email. You don’t need https:// or www. - Press Check site (or Enter). The check takes a few seconds, up to about 20 for slow sites.
- At the top you’ll see whether it looks like the real site, needs care or is likely fake or a scam, with the reasons in plain words.
- Below that is the security grade from A+ to F, a score out of 100 and a list of checks, with the problems at the top.
- Open How to fix under any failed check for the exact header to add, with examples for Apache, nginx and WordPress.
If you enjoy what we do, consider supporting us. Every little bit means the world! Support Catpool on Ko-fi
Is this the real site?
Before the security grade, Website X-Ray checks the address itself for the tricks fake sites use. The security grade rates how well a site is set up, not whether it’s genuine, so a scam site can still get an A+.
- Lookalike letters: swapped characters such as 0 for o or rn for m, and international letters (punycode, addresses starting
xn--) that look identical to normal ones. - Borrowed brand names: names like PayPal, HMRC, Royal Mail or your bank in a domain they don’t own, such as
paypal-secure-login.top. - Disguised addresses: a real-looking start hidden in a subdomain, such as
paypal.com.account-verify.net, and bare IP addresses instead of a name. - Risky endings: cheap domain endings such as .top, .xyz, .click and .site, which are popular with scammers (plenty of honest sites use them too).
- Brand-new domains: we look up when the domain was registered. Scam sites are usually only days or weeks old.
Notes about the link
If you paste a whole link, we also tell you if it redirects to a different website, goes through a link shortener or QR redirect service that hides where it leads, contains an email address (scam links use this to pre-fill a fake login or track who clicked), or carries random tracking codes. To dig deeper into a link, use Link X-Ray.
What the security grade checks
HTTPS and the redirect (35 points)
We check the site loads over HTTPS, and that the plain HTTP version redirects there. Without HTTPS, anyone on the same Wi-Fi or network can read and change what visitors see and send. We also note the TLS version: TLS 1.2 and 1.3 are current, and anything older should be switched off.
The certificate (15 points)
We read the site’s TLS certificate to see who issued it, which names it covers and when it expires. An expired certificate, or one for a different name, makes browsers show a full-page warning, so either one sets the grade to F. Certificates from Let’s Encrypt and similar last 90 days and renew automatically, so a short countdown is normal as long as renewal works.
Strict-Transport-Security (15 points)
HSTS tells browsers to use HTTPS only for this site, even if someone types http:// or clicks an old link. That closes the small gap before the redirect where an attacker could step in. We look for a max-age of at least 180 days, and note includeSubDomains and preload.
Content-Security-Policy (15 points)
A CSP lists where scripts, styles, images and frames may load from, which stops most cross-site scripting attacks. It’s also the hardest header to get right, because a strict policy can break plugins, analytics and embeds. Start with Content-Security-Policy-Report-Only, which reports problems without blocking anything. We award partial points for report-only, and for policies that allow 'unsafe-inline' or 'unsafe-eval' scripts.
The smaller headers (20 points)
- X-Frame-Options or CSP
frame-ancestors: stops other sites loading yours invisibly in a frame to trick people into clicking (clickjacking). - X-Content-Type-Options: nosniff: stops browsers guessing file types, which blocks some attacks using uploaded files.
- Referrer-Policy: controls how much of your page address is shared with other sites when visitors click away.
- Permissions-Policy: switches off features like the camera, microphone and location for your site and anything embedded in it.
Extra notes (no points)
We also mention software version numbers shown in headers, cookies on the home page that are missing the Secure, HttpOnly or SameSite flags, and the outdated X-XSS-Protection header. Cookie values are never shown or stored, only their names and flags.
How the check works, and what it doesn’t do
Catpool’s server visits the site’s home page once over HTTPS and once over HTTP, exactly as a browser would, follows up to five redirects, and reads only the response headers and certificate. It never reads page content, submits forms, logs in, scans ports or probes for weaknesses. So it’s a quick check of how a site is set up, not a penetration test. A site can score A+ and still have a vulnerable plugin, so keep WordPress, themes and plugins up to date as well.
To prevent misuse, the checker only visits normal public websites on ports 80 and 443. Addresses that point to private, local or reserved networks are refused, and every redirect is checked the same way. Each visitor can run a few checks every ten minutes, and results are cached for ten minutes, so repeat checks of a site show the same result and don’t visit it again.
Privacy
We don’t store the addresses you check against your identity, and we don’t keep a history. A cached result for each site is kept for ten minutes so repeat checks are fast, then deleted. Your IP address is used only as a short-lived, scrambled counter for the rate limit. The site you check will see a visit from Catpool’s server, identified as CatpoolSecurityChecker, not from you.
Frequently asked questions
How do I add these headers on WordPress?
The easiest places are your host’s control panel (many have a “security headers” or HSTS switch), a security plugin, or a small Code Snippets snippet using the send_headers action. If your site uses Cloudflare, you can add them with a Transform Rule. Add one header at a time and test your site after each, especially CSP.
Why is my result different from other header checkers?
Every checker weights things differently. We focus on the headers that make a real difference for most sites and explain each one. Some sites also send different headers to different visitors, or only on certain pages.
It says the site couldn’t be reached.
The site may be down, blocking automated visitors, or very slow. Some firewalls block requests from servers. Try again later.
Can I check a page rather than the home page?
You can paste any page or link. The fake-site checks look at the whole link, and the security grade looks at the home page, because security headers are almost always set site-wide.
The site got a good grade. Does that mean it’s safe?
No. The grade only shows how well the site is set up. Scammers can set up HTTPS and security headers too, so always read the “Is this the real site?” verdict at the top, and if a message asks you to log in or pay, type the company’s address yourself instead of using the link.
Related: Catpool home, Security, Link X-Ray, Header X-Ray, File Hash Checker, QR X-Ray.
