How hackable is your website?
A 20-second check of what attackers look at first: HTTPS, browser protections, email spoofing and exposed files. You get a grade, plain-English fixes and a link to share.
- Connecting over HTTPS
- Reading browser protection headers
- Looking up email spoofing records
- Looking for exposed files
This check looks at the front door. We test the whole building.
Real breaches happen behind the login: broken access control, business logic, APIs and AI features. A penetration test finds those, and our retest proves the fixes work.
Fix:
The basics attackers test first.
HTTPS
A trusted certificate that isn't about to expire, plain HTTP sent to HTTPS, and HSTS so browsers never fall back.
Browser protection
Content Security Policy, clickjacking protection and the other headers that stop injected code and framing.
Email spoofing
SPF and DMARC records, which decide whether a phishing email in your name gets delivered.
Exposure
Public .git folders and .env files, advertised software versions, cookie flags and a security contact.
About the check.
Is it safe to run on my website?
Yes. It makes about six ordinary requests, the same as one visitor opening your home page, plus two public DNS lookups. It doesn't log in, guess passwords, submit forms or try exploits.
Can I check a website that isn't mine?
Only with the owner's permission. The checks are passive, but testing other people's systems without consent isn't something we support, which is why we ask you to confirm it.
How is the grade worked out?
Each check carries points, 100 in total, weighted by how much it matters to an attacker. 90 and above is an A, 75 a B, 60 a C and 45 a D. A site without working HTTPS, or with a public .git folder or .env file, gets an F whatever else it scores.
Do you keep the results?
We keep each result for 90 days so its share link works, along with a one-way hash of your IP address to stop abuse. Shared links never show leaked-file details. See the privacy policy.
I got an A. Am I secure?
You've got the basics right, which many sites don't. But this check can't see behind your login, where most serious issues live: who can see whose data, what your APIs allow and how your AI features behave. That's what a penetration test is for.
Get secured.
Tell us what you're shipping. You'll get a scoped, fixed quote within one business day.