A free website check on our home page

Until now, the only way to see how secure a website looked was to create an account and run a full scan, which takes several minutes. Some visitors just want a quick answer first.

Now there is one. Enter a website address on our home page and the results appear right there, usually in under 10 seconds. No account, no email, no credit card.

What the free check looks at

Six things anyone on the internet can already see about a website, each shown as good, could be better, needs attention, or not measured:

• Encryption. Whether the site is served over HTTPS, whether browsers trust its certificate, when the certificate expires, and whether old versions of TLS are still accepted.
• Security headers. The six browser protections we check in the full scan, judged by their values, not just whether they are present.
• Cookies. Whether the cookies the home page sets are protected with Secure, HttpOnly and SameSite.
• Email protection. SPF and DMARC, and whether DMARC is actually enforcing, which decides whether email sent in your name is blocked.
• Certificate authority record. Whether a CAA record limits who may issue certificates for your domain.
• Page loads securely. Whether everything on the home page loads over HTTPS, and whether scripts from public CDNs carry integrity checks.

Each result comes with a short explanation and a plain-English hint about what to change.

What it is not

It is a surface check of public signals, not a penetration test. It reads the home page and public DNS records, the same as any visitor could, and nothing else. It does not test for vulnerabilities, look for exposed files or open ports, or check WordPress. Those stay in the full scan, which a free account runs on one website every month.

Not measured never counts as a pass. If a site's firewall turns the check away, or something does not answer in time, those rows are shown in grey as not measured, never as good.

The free check uses the same checks as the full scan, so what it tells you agrees with the full report.

Limits that keep it fair

To keep the check quick for everyone and stop it being misused:

• A short check that you are not a robot before each run.
• Up to five checks an hour from one visitor.
• A website's result is kept for six hours, so checking it again is instant.
• We do not store your IP address. The hourly limit uses a one-way code that is discarded after an hour.

A safety check on every scan

Behind the scenes, every scan now confirms first that the address is a real public website. Addresses that point inside a private network, at a device on your own network, or at a cloud provider's internal services are refused, both in the free check and in the full scan, with a message saying why. A normal public website is not affected.