Free tools

A first look at your exposure, without touching anything fragile.

Three basic checks for your public website and domain. Each one behaves like an ordinary visitor or reads public DNS — no scanning, no logins, no load on your systems.

Security headers check

See which browser protections your homepage sends — and which are missing.

1 page load

HTTPS & cookie check

Confirm visitors are forced onto HTTPS and your cookies are flagged securely.

1 page load

Email spoofing check

Check whether your SPF and DMARC records stop others sending email as you.

DNS only

These checks only look at what any visitor can already see. They are a starting point, not a penetration test — and should only be run on websites you own or are authorised to test.

Support free tools

Keep these tools free for everyone.

Donations help us maintain and develop free security tools for everyone's benefit. Give any amount you like — every contribution counts.