Security checkers
Passive, point-in-time reads of your external security posture — no agent, no signup, no intrusive testing. Pick a checker and get a result in seconds.
Security Headers Checker
HSTS, CSP, X-Frame-Options and more — instant pass/fail with copy-paste fixes.
Run check →
Free Website Security Scan
A–F grade across HTTP headers, TLS and exposed files in one read.
Run check →
Email / DMARC Checker
SPF, DMARC and DKIM — is your domain spoofable by phishers?
Run check →
SSL Checker
Certificate expiry, chain, hostname match and negotiated TLS protocol — instant read.
Run check →
Login Rate Limit Checker
Does your login page stop bots from brute-forcing passwords?
Run check →
Cookie Security Checker
Secure, HttpOnly and SameSite — are your session cookies protected?
Run check →
CSP Checker
Evaluate your Content-Security-Policy directive by directive — with plain-English fixes and a hardened version to copy.
Run check →
Subdomain Finder
Every subdomain in your certificate history — which are live, which point at third parties, which are dangling.
Run check →
Account tools
Continuous checks that need something about your domain — a DNS-verified claim — so they live behind a free account rather than in the open checkers above.
Need a deeper look?
The free checkers cover individual surfaces. The full external scan maps subdomains, open services, exposed secrets and known-exploited CVEs — run by an operator under your authorization.