HTTPS & connection
A · 100%3 of 3 in place
3 of 3 checks observedHow to improve → HTTPS & connectionFREE WEBSITE SECURITY CHECK
Free website security audit for your domain
Check HTTPS, security headers, SPF and DMARC for your domain. Get an IT-ready fix list with coverage and unanswered questions shown.
Reading service availability. No check has started.
Private results in about a minute when enough checks are observed. No email or phone required.
THE OUTSIDE VIEWIllustrative example
example.comYour score.
Your score.
A clearer next step.
See the signal, its limits and the next useful action.
Your best-practice score
90%of checked security best practices in place
StrongBased on 10 of 16 checks we could observe. 6 couldn't be observed and aren't counted — missing evidence is never marked as a failure.
Website hardening
B · 75%3 of 4 in place
4 of 8 checks observedHow to improve → Website hardeningEmail protection
A · 100%2 of 2 in place
2 of 3 checks observedHow to improve → Email protectionDomain & certificates
A · 100%1 of 1 in place
1 of 2 checks observedHow to improve → Domain & certificatesTHE NEXT STEP
Give the right owner a question they can act on.
Format only. Invented observations, not a real business result.
An illustrative result, with sources and next steps.
PUBLIC CONFIGURATION. PRACTICAL NEXT STEPS.See what we check
01WHAT WE CHECK
Four areas.
A clear place to start.
Review the public configuration of your registered domain and its www root page. Each area links to a practical guide for your IT team.
HTTPS & connection
HTTPS availability, HTTP-to-HTTPS redirects and authenticated TLS connections.
Website hardening
HSTS, security headers, sampled cookie attributes and explicit HTTP resource references.
Email protection
SPF and DMARC records, with DKIM limits stated clearly. No selector guessing or test emails.
Domain & certificates
Served certificate expiry and public certificate-authority policy, with renewal questions for your IT team.
02HOW THE SCORE WORKS
Observed best practices.
Coverage always shown.
Your score is the share of observed checks in place. If 12 of 16 observed checks align, that is 75%. Unknown checks never count as pass or fail.
- 1
Confirm your domain.
Review the public scope before starting. No contact details are needed for the instant result.
- 2
See scores with context.
An area needs at least half its applicable checks observed to receive a grade. The overall score needs at least six observations and two graded areas.
- 3
Give IT a practical list.
Review dated observations, sources and recommended next actions with the administrator who can validate them.
03KNOW THE LIMITS
A useful first check.
With an honest scope.
The score describes observed public best practices. It does not certify your business, prove compliance or determine whether you have been compromised.
Read the scope and limitsThe public website boundary
- Your apex and www hostRoot pages on ports 80 and 443 only.
- Ordinary public checksPublic DNS, standard TLS connections and response headers and HTML. Up to five page requests including redirects.
- Unanswered stays unansweredBlocked or unavailable evidence remains unknown. A result can be partial.
QUESTIONS FOR A BROADER REVIEW
Internal access, MFA, endpoint protection, backup recovery and incident readiness need internal evidence. No logins, private-service checks or exploitation are included.
04WHAT’S NEXT
Turn the snapshot
into a plan for IT.
A free expanded external review adds an agreed public inventory and a dated remediation pack with suggested owners and an order of work. Availability and scope are confirmed separately.
Questions about the free audit
What does the free website security audit check?
It checks your domain’s public homepage (and its www host when that is where it leads), HTTPS connections, certificates, browser security headers and public SPF and DMARC records. DKIM needs a selector from your mail provider, so it is reported as not checked. Each result includes coverage and limits.
How long does it take?
A score and area grades usually come back in about a minute when enough checks are observed. Slow or unavailable sources can leave a partial result; the collection deadline is 90 seconds.
Is this free and do I need to give my email?
The instant audit is free. You can view your private result without providing an email address or phone number.
What does the score mean?
The score is the share of observed best practices in place. Unknown checks are uncounted and coverage is always shown. It is not a certification or an assessment of all business security.
Does it test DKIM signing?
A domain alone does not identify the selector used to sign messages. The instant audit does not guess selectors, so DKIM remains unknown without legitimate selector evidence.
Will this find every security problem?
No. Public configuration cannot establish internal access controls, backups, incident readiness or compromise. The audit does not log in or attempt exploitation.
What should I do with the fix list?
Give the dated observations and suggested priorities to the responsible IT or email administrator. Confirm application needs before changing settings, then agree any expanded review separately.
Security guides for your team
Start with the website security audit checklist and scoring guide, or explore a specific area.
Browse all security guides