Enter your domain to see, in seconds, whether criminals can send email in your name and whether your website uses the basic protections every browser expects. We only look at public information: your DNS records and the response any visitor's browser receives from your homepage.
Free, no sign-up. Results are cached for 10 minutes. We do not store your IP address. Only check domains you own or manage.
A Public Website Security Check ($790) adds a manual review of exposed files and admin panels, outdated software, forms and login pages, subdomains and more, with a plain-English report ranked by severity. No access to your systems needed.
See what's included Compare all packagesIt does not check DKIM (it needs a selector only your email provider knows), outdated plugins, exposed files, logins or anything that requires active testing. For the full picture, work through our 15-point website security checklist or order a review.
Yes. The check is free and needs no sign-up. It looks only at public information: your domain's DNS records and the response a normal browser receives from your homepage.
It checks SPF and DMARC email authentication, mail server records, whether http:// redirects to https://, the TLS certificate, and common security headers such as Strict-Transport-Security, Content-Security-Policy and X-Content-Type-Options.
No. It makes the same kind of request a browser makes when someone opens your homepage and reads public DNS records. It does not scan ports, test for vulnerabilities, submit forms or try to log in.
No. The tool covers a handful of visible basics. It cannot see outdated plugins, exposed files, weak logins or how issues combine. For that you need a full external review.
Results are cached for 10 minutes so repeated checks are fast. To prevent abuse we keep a hashed, anonymous rate-limit counter for up to an hour. We do not store your IP address or link checks to you.