Check the connection
Review SSL/TLS observations that help you investigate your site’s HTTPS setup.
SSL/TLS checks →Website security, explained clearly
Find the security gaps
you can start fixing.
Check your website’s SSL/TLS, security headers and email authentication. Get observations you can review with your web developer.
No registrationNo payment detailsNo hosting password
Built for owners who manage a business, not a security team.See exactly what’s included
Trust through transparencyPublished methodologyObservable evidenceClear assessment limitsRead our approach →
Three checks.
A clearer starting point.
See the signals your website presents to the internet, without giving anyone access to your admin account.
Review browser protections
Find security-header observations to discuss with the person who maintains your website.
Security headers →Review email authentication
Check the domain’s reported email-security signals and follow up with your mail provider.
Email authentication →From a domain name
to a practical next step.
No signup wall before you can see whether the scan is useful to you.
Enter your website
Use a public domain you own or have permission to assess. No hosting login needed.
Review the observations
Read each result and its evidence. Errors and unassessed checks need investigation, not assumptions.
Fix, then check again
Share the result with your developer. Export the evidence and retest after changes.
Example finding
Content Security Policy not observed
This example explains the workflow. It is not a finding about your website.
What it means
A Content Security Policy helps a browser restrict which resources a page can load.
What to ask your developer
“Can we review the resources our pages need and test a suitable policy before enforcing it?”
Make the result useful
A finding should start
a clear conversation.
You don’t need to become a security engineer to take the next step. Keep the observation, identify who can change it, and check the result after the work.
- Read observations before relying on a grade.
- Keep the target and scan date with your report.
- Use the full scanner for exports and browser comparisons.
An external scan is a starting point. It does not replace a penetration test, internal review or compliance assessment.
Before you scan
Is the scan really free?
Yes. Run the public website scan without creating an account or entering payment details. There is no paid subscription checkout in this release.
Does a good grade mean my website is secure?
No. The scan observes selected internet-facing signals. It cannot prove that your website is free from vulnerabilities or assess all internal controls, accounts, plugins or backups.
Will you need my passwords or access to my hosting?
The public scan does not ask for your hosting password or administrator credentials. Do not enter passwords, API keys or confidential URLs.
Are my scan results private?
Existing scanner results can have public shareable links. Only submit domains you own or have permission to assess, and treat result links as shareable. Browser baselines are saved locally only when you choose to save one.
Can I send the findings to my developer?
Yes. Use the existing share link or export the result as JSON. Include the domain, scan time and individual observations. PDF and email delivery are planned, not available in this release.
Start with your website.
Check its external security signals. No account or card required.