Completed on October 20, 2026
We found a few things to improve. Follow the steps below to make your business even safer.
Your domain does not have a DMARC record. This makes your business email more vulnerable to phishing and spoofing attacks.
DMARC helps prevent attackers from sending fake emails that look like they're from your business. It protects your customers and your brand.
3 of 6 recommended security headers are in place. Adding the rest helps protect your website from common attacks.
Security headers add an extra layer of protection, helping stop attackers from injecting malicious code or framing your site.
Your domain doesn't restrict which certificate authorities can issue certificates for it.
CAA records tell certificate authorities which companies may issue certificates for your domain, making fraudulent certificates harder to get.
Your website reveals exact software versions. This is a possible exposure, not a confirmed vulnerability.
Showing exact software versions makes it easier for automated attack tools to target known weaknesses.
DNSSEC isn't turned on for your domain. It's optional but adds protection against DNS tampering.
DNSSEC makes it harder for attackers to send your visitors to a fake copy of your website by tampering with DNS answers.
Your domain lists its approved email senders.
SPF tells email providers which servers are allowed to send email for your business, making it harder for scammers to impersonate you.
Visitors using http:// are sent to the secure version of your site.
Visitors who type your address without https:// should be sent to the secure version automatically.
Your website loads over an encrypted HTTPS connection.
HTTPS keeps the information your visitors send and receive private, and browsers warn people away from sites without it.
Your certificate is valid and trusted for another 49 days.
An expired or invalid certificate makes browsers show a full-page warning that drives customers away.
Your website uses TLS 1.3, and we didn't detect support for retired versions.
Old encryption versions (TLS 1.0 and 1.1) have known weaknesses and are no longer considered safe.
Your homepage doesn't set any cookies.
Cookies without the right flags can leak over unencrypted connections or be sent with requests from other sites.
Your domain was not found on the blocklists we checked (Phishing.Database).
A clean domain reputation helps your emails reach customers and shows your business is trustworthy.
Email for your domain is handled by Microsoft 365.
MX records tell the internet where to deliver email for your domain.
We couldn't find DKIM at common selector names. That doesn't mean it's missing. Confirm it's turned on in your email provider.
DKIM adds a digital signature to your emails so providers can confirm they really came from you and weren't altered.
Your website appears to run on WordPress, served through Sucuri.
Knowing your platform lets us tailor the fix instructions to your setup.
Turn on monitoring and get alerted to new issues before they become problems.