Loading…
Loading…
Cookies and privacy
We use strictly necessary cookies to run the site. With your permission we also load Vercel Web Analytics and Speed Insights to measure traffic and performance in aggregate. See our Cookie Policy and Privacy Policy.
Wix sites
Wix handles a lot of the hardening for you, but the public posture still depends on the domain you connect, the apps you install, and how you configure email and redirects. Without a baseline, it's easy to ship a polished design while your apex still misses HSTS, CSP, or DMARC.
Paste the URL visitors actually load — usually your custom domain on apex or www. Scorifya checks what unauthenticated browsers can see: HTTPS posture and redirects, security headers, passive SPF/DMARC/MX context, cookie-related hints when responses carry Set-Cookie, and hygiene signals. It complements Wix's platform protections; it does not log into your editor or scan internal storage.
This page is written for people searching for Wix security check—same tool as the homepage, with context for that query.
How we differ from deep TLS graders, browser-focused posture tools, and header-only checkers: read the comparison.
Illustrative snapshots of what a report can look like—paste your URL above for a live score on your site.
Example A — common gaps after a custom-domain switch
TLS works, but the apex/www redirect chain plus a few missing browser headers leave points on the table until edge config is consistent.
Strict-Transport-Security missing
Without HSTS, browsers may still allow accidental HTTP before policy is cached — especially first visits and old social-share links.
Content-Security-Policy absent
No CSP means browsers rely on defaults; XSS blast radius stays higher until a baseline policy is in place.
DMARC at p=none only
Reports are flowing, but spoofed mail can still reach inboxes. Move to p=quarantine after triaging the report stream.
Example B — tighter public edge posture
Redirects, TLS, and the headers Wix ships look consistent across apex and www. Email DNS is the last category with room to mature.
Permissions-Policy missing
No explicit denies for camera/microphone/geolocation. A short header tightens the contract with your origin and embeds.
Verbose Server banner
Fingerprinting hints rarely flip the score alone but show up during hygiene passes.
Connect your custom domain on both apex and www
Use Wix's domain manager so HTTPS is consistent across both hosts. Scorifya rescores when redirects line up cleanly.
Enable HSTS at your DNS or CDN layer
Wix terminates TLS for you, but if you front the site with Cloudflare or similar, set HSTS there with a deliberate max-age and grow it after coverage is verified.
Add DMARC and progress past p=none
Publish SPF, DKIM, and a starter DMARC record. Once aggregate reports stabilize, move policy to p=quarantine then p=reject.
Audit installed Wix apps for trackers
Third-party apps inject scripts; if you ever add a CSP at a fronting CDN, allowlist only what you actually use.
Re-scan after each domain or app change
Custom domain changes, app installs, and DNS edits all shift what we observe. A fresh paste catches regressions early.
For weights and penalties behind each category, see How Scorifya works.
No. Scorifya only requests the public URL you paste and follows redirects. It cannot access authenticated areas, your editor, or member-only pages.
Wix handles the basics (HTTPS, platform patches), but the headers, DNS, and redirect chain depend on your domain config. Scorifya measures what visitors' browsers actually see end-to-end.
No. This is a configuration and public-signal scorecard, not malware or vulnerability detection. Use Wix's app-store reviews and your own tracker hygiene for that.
Different hostnames can have different redirect chains, certs, and headers. We score the URL you paste; rescan both apex and www to see whether they match.
No. We do not attempt exploitation or authenticated crawling. The score reflects publicly visible TLS, headers, DNS/email signals, and hygiene.
More detail on limits and billing: FAQ.
TLS, HTTPS & redirects
Valid certificates, modern TLS, and clean HTTP→HTTPS upgrades. We also probe whether legacy TLS 1.0/1.1 are still accepted.
Security headers
CSP, HSTS, and related headers reduce common browser-side attack surfaces and clickjacking risk.
DNS & email (passive)
SPF, DMARC, a few DKIM selectors, MX, and whether common subdomains resolve publicly—without port scanning.
Hygiene signals
Verbose server banners and risky defaults can raise your attack surface and erode trust.
Not a vulnerability scan
Scorifya checks public configuration signals; it does not attempt exploitation, port scans, or authenticated crawling.
If you're iterating on headers or deploying changes, you'll likely run multiple checks as you tighten config. When you're ready, Scorifya Pro removes scan limits and unlocks JSON/CSV/PDF exports.