Public URL check
Website safety check
Website safety check: HTTPS, redirects, scam signals and risks
What URLCompass checks
Enter a website address and URLCompass reviews public safety signals: HTTPS, status code, final URL after redirects, mixed content, security headers and forms on the page.
HTTPS, redirects and mixed content
The report shows whether the page loads over HTTPS, where the final URL points and whether a secure page still loads insecure http resources.
Security headers
URLCompass checks HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy. These signals do not prove a site is harmless, but they show how carefully the basic protection is configured.
How to use the result
If HTTPS is missing, mixed content is present, forms are insecure or important headers are absent, avoid entering passwords or payment data until you verify the site another way. Site owners should fix certificates, redirects, forms and security headers.
Example result
What the report can show before you open it
The exact values depend on the URL, but the report highlights practical signals instead of a raw technical dump.
HTTPS, TLS certificate, mixed content, security headers, SPF, DMARC, CAA and DNSSEC.
HSTS, CSP, X-Frame-Options, X-Content-Type-Options and Referrer-Policy.
SPF, DMARC, MX, CAA and DNSSEC as public domain-protection signals.
The report groups output into critical issues, recommended fixes and useful context.
Report sections
The scan keeps the result readable
Connection
HTTPS, status code, final URL and mixed content.
Security headers
HSTS, CSP, X-Frame-Options, X-Content-Type-Options and other protective headers.
Forms and input
Form count, password fields and forms that submit data over insecure HTTP.
FAQ
Common questions
Does URLCompass need access to the website admin area?
No. The report is built from public signals available by URL: HTML, headers, DNS, TLS, robots.txt and sitemap.xml.
Can it show exact traffic or private analytics?
No. Exact traffic requires analytics access or paid data sources. URLCompass intentionally separates public checks from private metrics.
What should I do after the report?
Start with failed checks and warnings: indexability, HTTPS/TLS, security headers, page speed, missing metadata and weak DNS/mail protection.
Which URLs can be checked?
Use public http or https pages. Localhost, private IP addresses and closed admin pages are blocked to keep the checker safe.