Check your website's security
Enter your site's address and get a seconds-long surface look: security headers, cookies, trackers, HTTPS and email setup (SPF/DMARC). No active scanning, only what's public.
Monthly monitoring
We tell you when something changes
We re-check the site once a month and only write to you when a new problem appears or an old one is gone. If nothing changes, you get no email.
Go deeper?
Want a full review?
The report above is only the surface. A real review goes into code, infrastructure and configuration. Write to us.
Or directly: [email protected] · +40 775 636 880
Fig. 01 / What the check covers
What we check, in short
Transport and certificate
Whether the site is served over HTTPS, whether the http:// address actually redirects to the secure version, whether the HSTS header is fully configured, and whether the newest public certificate for the domain is close to expiring.
Security headers
Content-Security-Policy, clickjacking protection, X-Content-Type-Options, Referrer-Policy and Permissions-Policy. These are the settings that stop ordinary browser attacks before they start.
Cookies and tracking
Which cookies a visitor gets on the very first load, whether they carry the Secure, HttpOnly and SameSite flags, and whether analytics cookies are set before any consent. That last one is a GDPR problem, not just a technical one.
Email and anti-spoofing
Whether someone can send email that looks like it came from your domain. We check SPF and how permissive it is, DMARC and whether its policy actually blocks anything, DKIM at the common selectors, plus MTA-STS and TLS-RPT.
DNS and domain
DNSSEC, CAA records, and the subdomains that show up in public certificate transparency logs. This is where forgotten test environments and dangling subdomains that someone else can take over come to light.
Code and libraries
The JavaScript libraries on the page, looked up live in the public OSV database for known vulnerabilities (CVEs). Plus the CMS version, content loaded over http on an https page, and external scripts without Subresource Integrity.
What you leave on show
Server versions exposed in headers, administrative routes listed in robots.txt, a missing security.txt, and whether there is a CDN or WAF in front of the origin server.
Fig. 02 / Frequently asked
Frequently asked
What does "surface check" mean?
We only look at what your site publishes to anyone: the response headers, the HTML of the main page, public DNS records, public certificate transparency logs, and the files meant for bots, which are robots.txt and security.txt. We send no attack traffic, we try no passwords and we hunt for no hidden files.
Is this legal? Do I need permission?
The check uses public information only, exactly what an ordinary visitor or a search engine sees. We still ask you to confirm that you own the site or have permission, because the report is built to reach someone who can act on it.
Is this the same as a cybersecurity audit?
No. The audit regulated by Romania OUG 155/2024 can only be carried out by DNSC-accredited auditors and means far more than this. This check takes a few seconds and covers only the layer visible from outside. It is a starting point, not a certificate.
What does the score mean?
The score starts at 100 and drops with every problem found, weighted by how serious it is. A low score does not mean the site was breached, it means a lot of doors were left unlocked. The list of problems matters more than the number.
What is a dangling subdomain?
A subdomain that points via CNAME at a service that no longer exists, for example a closed hosting account or a deleted bucket. Whoever registers that target can publish any content on your address, with a valid certificate. It is one of the easiest problems to exploit and one of the least often noticed.
What do you do with my data?
We keep the scanned address, the result and the IP address the request came from for 90 days. Shared report links expire with them. If you turn on monthly monitoring, we keep your email address until you unsubscribe. The details are in the Privacy Policy.