Check public website headers, scripts and email authentication. Owners can also verify a domain for limited service-port checks.
Need more detail? Run the deep security, SEO and performance audit →
One successful check per connection per UTC day. If a check fails, you can retry. People on the same network may share this allowance. We retain the domain, time, and result for future reference, plus a private keyed daily usage marker for successful checks; this form does not ask for personal contact details.
See the certificate issuer and expiry date for the public HTTPS endpoint.
Review common browser protections such as HSTS, Content Security Policy, and frame controls.
Inspect the domain's published web and mail records, including A and MX records.
Check whether SPF and DMARC TXT records are published for the exact domain entered.
Review frame restrictions and use a safe visual overlay demonstration to understand the risk.
List third-party script domains in homepage HTML and note whether an integrity attribute is present.
Sample common mail selectors and inspect the RSA public-key length when available.
Run limited TCP checks only after the domain owner publishes the requested DNS verification record.
A missing header or record is a prompt for further review, not proof of a vulnerability. Some controls depend on your hosting setup and email configuration. The weighted score covers the original SSL, header, SPF and DMARC checks; advanced findings are informational. Optional TCP port checks require a DNS ownership proof and may be inconclusive if outbound connections are filtered. This tool does not test applications or validate every policy value. If your site redirects, enter its final domain and run the check again.