How does your website look from the outside?
Type your website address. In about ten seconds you get a grade and a short list of plain-English fixes.
This is a passive outside check. It is not a penetration test and it is not security advice.
Free. No signup. Passive outside check only: we look at what any visitor can see.
What we check
- HTTPS. Visitors who type the plain address should land on the secure one.
- Certificate. When it expires and who issued it. An expired one scares visitors away.
- Domain renewal. A lapsed domain takes your website and email down with it.
- Security headers. Four short settings that make browsers harder to trick.
- Software versions. Old versions on show tell attackers where to look.
- Email spoofing. SPF and DMARC stop strangers sending email that looks like yours.
We make one request for your homepage, one secure connection, a few public DNS lookups and one lookup in the public domain registry. Nothing more.
Frequently asked questions
What does the scan look at?
Seven things any visitor can see: whether plain http:// moves to https://, your security certificate and when it expires, when your domain name is due for renewal, four common browser security headers, software versions your site shows publicly, and your SPF and DMARC email settings.
Is this a penetration test?
No. It is a passive outside check. We load your homepage once, make one secure connection, read public DNS records and ask the public domain registry for a renewal date. We never try paths, ports, logins or forms, and we do not try to break in.
Is it security advice?
No. It tells you what is visible from outside and suggests plain next steps. It cannot see inside your server, so a good grade does not mean the site is safe, and a poor grade does not mean it has been attacked. Ask your web developer or host to confirm anything that matters.
What do you keep?
The scan runs on the address you type and the result is shown to you. We only fetch public websites. We never send cookies or log in, and checks are rate-limited per visitor.
Why does it mention PHP?
Some servers announce their PHP version to every visitor. Versions below 8.2 no longer receive security fixes from the PHP project, though some hosts patch older versions without changing the number. If your site shows an old version, we point you to our PHP2Shell Patch Check.