Free website security scan

What does this checker look at?

The scan looks at the parts of your business that anyone on the internet can see: your website, your domain's DNS settings, and the records that protect your business email. It groups the results into three areas.

Your website

The scan checks whether:

• your site loads over an encrypted connection (HTTPS), and visitors who type http:// are sent to the secure version automatically
• your SSL certificate is valid, trusted by browsers, and not about to expire
• your server uses modern encryption (TLS 1.2 or 1.3), or still accepts the retired TLS 1.0 or 1.1
• your site sends six browser security settings called security headers, including HSTS and clickjacking protection
• your server or platform announces exact software version numbers
• cookies set by your homepage use the Secure and SameSite flags

It also notes which platform your site appears to run on, so fixes match your setup.

Your email

We look up your MX records to see which provider handles your email. Then we read your SPF record and count its DNS lookups against the 10-lookup limit, check your DMARC policy and reporting address, and look for DKIM signing keys at common selector names.

Your domain

We check whether your DNS records are digitally signed (DNSSEC) and whether your domain limits which companies can issue certificates for it (CAA). We also look for your domain on the Phishing.Database blocklist, and on URLhaus when it's available.

How do I read my results?

Each check gets a plain-English status. You don't need to understand every term to know what to do next.

• Green statuses like "Enabled," "Valid," "Configured," "Protected" or "Good" mean that check is in good shape. No action needed.
• Needs attention means something is missing or misconfigured in a way that affects visitors, deliverability or impersonation risk. Fix these first.
• Worth improving, Partially configured, Monitoring only or Expiring soon mean the basics are in place but could be stronger, or something will need attention soon. These are your next steps once the urgent items are done.
• Info is context, like your website platform or email provider. It's there to tailor the fixes, not to flag a problem.
• Couldn't check means we couldn't complete that test, usually because of a temporary network or DNS hiccup. Try again in a few minutes.

A couple of results deserve extra context. DKIM uses selector names that differ by provider, so "Not detected" doesn't always mean it's missing. Confirm it's turned on inside your email admin console. And a visible software version is a possible exposure, not a confirmed weakness. The bigger priority is keeping that software updated.

To see a full report before you run one, open our example report.

How do I fix common problems?

Every finding in your report includes a fix with numbered steps, a time estimate, and tabs for common providers. Here are the guides for the issues we see most often:

• If your site has no HTTPS or shows a "Not secure" warning, follow why your website says Not Secure.
• For an expired or untrusted certificate, see what to do when an SSL certificate expires, then confirm with the SSL checker.
• When DMARC is missing or set to monitoring only, the DMARC policy not enabled fix has the exact record to add.
• For SPF or spoofing problems, how to stop email spoofing covers SPF, DKIM and DMARC together.
• If security headers are missing, see which ones with the security headers checker. WordPress owners can also work through our WordPress security checklist.
• If your domain is on a blocklist, read how to tell if your website is hacked and start cleanup promptly.

After you make a change, re-run the scan. Your new report shows what moved from "Needs attention" to green.

Is this check safe to run?

Yes. The scan is passive. It reads the same public information any browser or mail server can see: your homepage over HTTPS and HTTP, your certificate, and your public DNS records.

It doesn't install anything, change any settings, log in to your site, scan ports or look at your files. It isn't a penetration test or an audit. A clean result means the public-facing basics we check are in good shape, not that nothing could ever go wrong.

The full scan saves your results so you can open your report from a private link and compare later scans. You can read more about what we keep and why in our privacy policy, and see every test in detail on what we check.