w3schools.com
Measuring…
w3schools.com
Scanned:
77/ 100
Score by axis
- Security61
- Performance100
- SEO56
- Reputation100
Watch this site's security
We'll email you if its security slips — a new vulnerability, an expiring certificate, a blacklisting. No account needed.
Security alerts only — nothing else, and no email unless something is wrong. Unsubscribe anytime.
Want more than security alerts?
Coming soonMonitor — daily re-scans across all five axes, instant alerts on new and cert expiry, Telegram & web push, and full history.
Fix what matters first
- 1+5
- 2Core security headersHow to fix this →+5
Add X-Content-Type-Options, X-Frame-Options, and Referrer-Policy.
- 3HSTS (Strict-Transport-Security)How to fix this →+4
Add `Strict-Transport-Security: max-age=31536000; includeSubDomains`.
- 4Meta description+2
Aim for a meta description of about 50–160 characters.
- 5Canonical URL+2
Add <link rel="canonical"> to avoid duplicate-content issues.
Recommendations are ranked by their impact on your score.
All checks
Security
61/ 100- Pass
HTTPS & HTTP→HTTPS redirect
HTTPS available; HTTP redirects to HTTPS
- Warn
TLS certificate validity
Certificate expires in 26 days
expires 2026-08-16 · R12Good: valid certificate with 30 days or more to expiry
Renew the certificate soon, or enable auto-renewal.
- Warn
HSTS (Strict-Transport-Security)
No Strict-Transport-Security header
Add `Strict-Transport-Security: max-age=31536000; includeSubDomains`.
- Pass
Content-Security-Policy
Present
frame-ancestors 'self' https://mycourses.w3schools.com https://pathfinder.w3scho… - Fail
Core security headers
None present
Add X-Content-Type-Options, X-Frame-Options, and Referrer-Policy.
- Pass
Mixed content (HTTP on HTTPS)
No insecure (http://) subresources
- Pass
SPF email anti-spoofing
record present
v=spf1 include:_spf.google.com include:amazonses.com include:spf.sendinblue.com include:shops.shopify.com include:mail.zendesk.com ip4:148.122.215.227 -all - Pass
DMARC email anti-spoofing
record present
v=DMARC1; p=reject; rua=mailto:postmaster@w3schools.com; pct=100; adkim=r; aspf=s - N/A
Vulnerable front-end libraries
No recognizable front-end library versions detected
- N/A
CMS known vulnerabilities
No CMS detected
Performance
100/ 100- Pass
Time to First Byte
Fast
14 msFast: under 800 ms · Moderate: 800–1800 ms · Slow: over 1800 ms
- Pass
Text compression
Enabled
gzip - Pass
HTTP/2 or HTTP/3
Modern
HTTP/2.0Modern: HTTP/2 or HTTP/3 · Outdated: HTTP/1.1 or older
- Pass
Cache-Control
Present
public, max-age=7831 - Pass
Core Web Vitals (PageSpeed)
perf 62/100, 2.0 s, 0.00 (field)
Good: 2.5 s or less · INP 200 ms or less
SEO
56/ 100- Pass
Page title
30 characters
W3Schools Online Web TutorialsGood: 10–70 characters
- Warn
Meta description
168 characters
Well organized and easy to understand Web building tutorials with lots of examples of how to use HTML, CSS, JavaScript, SQL, Python, PHP, Bootstrap, Java, XML and more.Good: 50–160 characters
Aim for a meta description of about 50–160 characters.
- Warn
Canonical URL
No canonical link
Add <link rel="canonical"> to avoid duplicate-content issues.
- Pass
- Warn
XML sitemap
No sitemap found
Publish a sitemap.xml and reference it from robots.txt.
- Warn
Single H1
18 H1 tag(s)
Use a single <h1> per page.
- Pass
Image alt text
21/21 images have alt (100%)
Good: 90% or more with alt text · Poor: under 50%
- Warn
Structured data (JSON-LD)
No structured data
Add schema.org to enable rich results.
Infrastructure
90/ 100- N/A
CMS detection
No CMS fingerprint detected
- N/A
Web server
Server header not exposed
- N/A
CDN detection
No CDN fingerprint detected
- Pass
TLS version
Up to date
TLS 1.3Up to date: TLS 1.2 or 1.3 · Deprecated: TLS 1.0 or 1.1
- Pass
IPv6 (AAAA record)
AAAA record present
2600:141b:1c00:44::17db:2454
Reputation
100/ 100- Pass
Google Safe Browsing
Not flagged
checked: Google Safe Browsing - Pass
Domain blacklist status
Not on major blocklists
checked: Spamhaus DBL, SURBL - Pass
Domain age
Registered ~26 years ago
2000-03-21Good: 90 days or more since registration
- Pass
Domain expiry
Expires in 243 days
2027-03-21Good: 30 days or more to expiry
Go deeper
This scan is passive. An attacker won't be.
The free scan reads what your site shows everyone. A Deep Audit does what an attacker does — it actively probes your verified site for what's really exposed.
This free scan (passive)
- Security score
- Known-CVE counts
- Security headers
- TLS & certificate
- Blacklist & Safe Browsing
Deep Audit — active scan of your verified site
- Per-CVE breakdown: IDs, severity, exploit availability, fix version
- Exposed files (.git, .env, backups)
- Directory listing
- Open admin panels
- Open ports
- Subdomain exposure
- Prioritized fix plan
- Full PDF report
What we can't check without your permission
These need active probing of your site: exposed .git/.env/backups, open admin panels, open ports, forgotten subdomains. Verify your domain and we'll show you what an attacker would find.
How it works
- Verify your domain — a file or DNS record, about 2 minutes.
- We actively scan it — a few minutes; we email you when it's ready.
- Get your full report + PDF.
The deep scan is live and free while we're in early access. Verify your domain and run it now.
Active checks run only on a domain you've verified as yours, with your consent. We detect — never exploit. Free in early access; $39 one-time after launch, no subscription — and early adopters keep the deep scan free.
Run a free deep scanShare this report
Get the badge
Embed this badge on your website — it links back to this full report.
<a href="https://chkweb.com/report/w3schools.com"><img src="https://chkweb.com/badge/w3schools.com.svg" alt="Website security checked by CheckWeb" /></a>