Have the whole website handled
Build or migrate the site, then keep hosting, security, monitoring, and updates with one accountable engineer.
Managed website service →Free security scan
Is your website leaving the door open?
Enter your domain and get an instant, plain-English setup grade for your certificate, protective headers, email spoofing policy, DNS, and edge protection. No signup and nothing installed.
Public signals onlyNo signupUsually about 10 seconds
Type your domain without https:// — for example acmedental.com. Identical-domain results may be cached briefly to prevent abuse; nothing becomes a customer record unless you contact us or create a shareable report.
What this checks
Eight things every small business site should get right.
Secure connectionYour certificate is valid and every visit is encrypted end to end. What this means
Always-encrypted (HSTS)Browsers are told to never load your site over an insecure connection, even on hostile networks.
Domain spoofing policy (DMARC)Your domain publishes a handling preference for messages that fail DMARC; participating receivers use it alongside their own local policy. What this means
Sender protection (SPF)A public record declares which servers are allowed to send mail for your domain.
Protective headersThe quiet browser rules that block clickjacking and content tricks. What this means
Edge protectionSomething stands between your site and the automated attacks that hit it daily. What this means
DNSSEC-signed DNSValidating resolvers can detect forged or altered DNS answers instead of silently accepting them. What this means
Transfer lockYour domain can't be quietly moved out from under you. What this means
This scan reads only public information and never touches your systems. It's a starting point, not a full audit — but every red mark is a real gap worth closing.
Before you scan
Questions people ask first
Is it safe to run this scan on my own website?
Yes. The scan reads only information your site already publishes to every visitor — your certificate, your DNS records, your response headers. It never logs in, never submits forms, and never touches your server beyond loading it the way a normal browser would. It cannot slow down or break anything.
Do you store my domain or my results?
Not as a customer record. Identical-domain results may be cached for up to 10 minutes to prevent abuse and repeated third-party lookups. A report snapshot is stored for 90 days only when you explicitly create a shareable link.
My website looks fine in a browser. Why would email spoofing matter?
Because the attack never touches your website. A sender can place your domain in the visible From address, then rely on weak or missing authentication policy to improve the odds that the message is accepted. An enforcing DMARC policy materially reduces that risk, although each receiving provider still applies its own local security policy.
I got a bad grade. What should I fix first?
Your report lists findings in priority order — problems first, ranked by severity. Broadly: a broken secure connection and a missing domain spoofing policy outrank optional hardening, followed by protective headers and the domain transfer lock. Every finding explains what it is and how it gets fixed — by you or by us.
Is this scan a full security audit?
No, and be wary of any instant tool that claims to be. This grades your public-facing configuration — the locks on the doors. It can't see your website's code or plugins, and it can't tell whether the site has already been compromised. It's the right place to start because most small-business sites fail at least one of these fundamentals.