Website Health & Security Checker

Security

Enter a domain below and the checker reads what its public configuration says about HTTPS, its certificate, six response headers, and its email authentication records (MX, SPF and DMARC). It runs on this page, free, with no account and nothing to install.

The full scope and limitations of what this tool does and does not check are set out below the results.

Website Health & Security Checker

Enter a domain and we will read what its public configuration says about HTTPS, its certificate, a few response headers and its email records. Free, with no account.

A public domain, for example example.com. Standard web ports only.

These are configuration checks against publicly available information. They do not detect malware, test for vulnerabilities or constitute a penetration test, and a clean result is not a guarantee that a website is safe.

How to read your results

Every check the tool runs comes back with one of four states. There is no single score, because a score invites the question “am I safe”, which these checks cannot answer.

  • Passed: the specific setting we checked for is in place and does what it is meant to, for example a working HTTPS connection or a DMARC policy that actually acts on mail that fails authentication.
  • Needs attention: something is missing, weak, or set in a way that does not do much, for example no Strict-Transport-Security header, or an SPF record that ends in +all.
  • Not applicable: the check does not apply to this domain’s own setup, for example a domain that publishes no mail servers, or the finding is informational only, such as a header that names the server software. A missing mail server never makes SPF or DMARC not applicable, because a domain that receives no mail can still be forged.
  • Unavailable: the check itself could not complete, for example a DNS lookup timed out. This never means something is wrong. It means we do not know, and we say so rather than guessing.

Each finding has a Details button that shows what we actually saw (the raw header, record or status code) and, where there is a fix, a “How to fix” note. If you check the same domain again within a few minutes, you may see a note that the result is a recent one rather than being looked up again.

A worked example
Illustrative example only. The result below is invented to show what a realistic mixed outcome looks like. It is not the output of an actual check on example.com or any other site.

Say you ran the checker against example.com. A realistic mixed result might include findings like these:

  • HTTPS connection: Passed. The site answered over HTTPS with status 200.
  • TLS certificate: Passed. Valid for another 86 days, issued by a recognised authority.
  • HTTP to HTTPS redirect: Passed. Plain HTTP is redirected to HTTPS in one step.
  • Strict-Transport-Security: Needs attention. No HSTS header was sent.
  • Content-Security-Policy: Needs attention. No policy was sent.
  • X-Content-Type-Options: Passed. Content type sniffing is disabled.
  • Clickjacking protection: Passed. X-Frame-Options is set to SAMEORIGIN.
  • Referrer-Policy: Needs attention. No referrer policy was sent.
  • Server software disclosure: Not applicable. Recorded for information only, not counted as a problem.
  • Mail servers (MX): Passed. Two mail servers are published.
  • SPF record: Passed. A record is published and ends in ~all.
  • DMARC record: Passed. A record is published at _dmarc.example.com.
  • DMARC policy strength: Needs attention. The policy is set to none, which is monitoring only.

A result like this would show as 8 passed, 4 needing attention and 1 not applicable at the top of the results, which open on the items needing attention so the most useful next step is easy to find.

Limitations

This tool answers a narrow question well. It is worth being precise about what it does not do.

  • Only public configuration is read. Nothing on the server is scanned, no login is attempted, and no source code is inspected.
  • A passed result is not proof that a specific weakness cannot be exploited. It only means the setting we checked for was found.
  • The checker does not look for malware, outdated plugin or theme versions, weak passwords, exposed files, or application-level vulnerabilities.
  • It is not a penetration test. It sends no exploit attempts, and it reports what a header or DNS record says, not what could be done with it.
  • Results describe the moment the check ran. Configuration can change afterward without the result changing.
  • A lookup that fails is always reported as unavailable, never as a problem, because no honest conclusion follows from a check that did not complete.

Frequently asked questions

Is this a security guarantee?

No. It reads a handful of publicly visible settings and reports whether each one is in place. A fully passed result means those specific settings are correct, not that the site cannot be compromised some other way. Nothing here is offered as, or should be read as, a guarantee of security.

What is SPF/DMARC and why does it matter?

SPF and DMARC are DNS records that help a receiving mail server tell your genuine mail apart from a message forged to look like it came from your domain. SPF lists which servers are allowed to send mail on your behalf. DMARC tells receivers what to do with mail that fails that check, and can send you reports when someone tries. Without either, it is easier for someone to send a convincing fake email that appears to come from your address.

Why did a check come back unavailable?

A check reports unavailable when the lookup itself did not finish, for example a DNS query timed out or an HTTPS connection could not be completed. We never turn a failed lookup into a reported problem, so unavailable means we do not know, not that something is wrong. Running the check again after a few minutes often resolves it.

Do you store my domain or results?

A result is cached briefly on our server so checking the same domain twice in quick succession does not repeat the same lookups, and it expires automatically after a short time. We do not publish or keep a public history of domains people have checked. The domain you enter is never written into the page address, so a result page cannot be shared or indexed by a search engine.

How often can I run a check?

Freely, within reasonable limits. If you run several checks in a short space of time you will be asked to wait a little before running another. That limit exists to keep the tool available for everyone, not to discourage genuine use.

Related guides

For a walkthrough of what each finding means and how to prioritise fixes, read Understanding your website check results on the blog.

Would rather someone else fixed it?

If the checker found more than you want to take on yourself, tell us what it found and we will quote a fix. Ask us to fix it