Free website security check
Enter your website address and we will tell you what is fine, what to review and what is urgent. We check the website, the certificate and your domain's email, and explain it with no jargon.
What the check reviews
Connection and certificate
Whether your site loads over HTTPS, redirects to the secure version and how many days the SSL certificate has left.
Security headers
The instructions your server gives browsers to stop code injection, clickjacking and information leaks.
Content management system
Whether you use WordPress or another system and, when visible, whether the version is behind the latest release.
Domain email
Whether you have SPF and DMARC, the records that stop someone from sending fake emails in your company's name.
A passive, non-intrusive check
The check only reads what any browser sees when visiting your home page, plus your domain's public records. It does not try passwords, look for hidden files or launch attacks, so it does not affect your website. That is why it is indicative: a site with a good score can still have vulnerable plugins or poorly protected access that only a full audit reveals.
Frequently asked questions
Is it really free?
Yes. We do not ask you to sign up or give any details to see the result. If you want help fixing what comes up, you can leave your contact details, but it is optional.
Can the check affect my website?
No. We make the same requests a browser makes when opening your home page and check your domain's public records. We do not try passwords or launch attacks.
I got a bad score, am I in danger?
It depends on what failed. An expired certificate, a site without HTTPS or an outdated WordPress are urgent. Some missing headers are less serious but worth fixing. If you leave your details, we will tell you what to fix first.
My site got a good score, is it secure?
It is a good sign, but the check only sees the site from outside. A full audit also reviews plugins, users with access, backups and forms.
What are SPF and DMARC?
They are domain records stating which servers may send email in your name and what to do with fake emails. Without them it is much easier to impersonate your business to send fake invoices or request bank account changes.
Prefer a full audit?
We review your website inside and out, your email and your team's access, and give you a clear report with a fixed price to fix it.
Contact us