Free website security check
What an attacker's scanner sees first: your certificate and TLS, security headers, out-of-date software, open ports and email records. Enter a domain and get a plain-English report in about 15 seconds.
Five things it checks
| Area | What it looks at |
|---|---|
| Certificate and TLS | The certificate, its expiry, and which TLS versions the server accepts. |
| HTTPS and security headers | Whether plain HTTP redirects to HTTPS, and the headers that stop common browser attacks. |
| Software versions | Versions the server gives away (PHP, web server, OpenSSL, CMS), against their end-of-life dates. |
| Open ports | Risky services reachable from the internet, such as databases, Redis, RDP and SMB. |
| Email security | SPF, DMARC and DKIM: whether others can send email that looks like it came from you. |
Every finding comes with what it means and how to fix it. Give your email and I'll look at the results too, and reply with what I'd fix first.
Questions
What does the check look at?
Only what anyone on the internet can see: the certificate and the TLS versions the server accepts, whether HTTP redirects to HTTPS, the security headers, software versions the server gives away (checked against their end-of-life dates), risky open ports such as databases, Redis, RDP and SMB, and the SPF, DMARC and DKIM records for email.
Is it safe to run on my site?
Yes. It loads the home page and makes one connection to each of 19 common ports, no more than a browser or a search engine would. It doesn't log in, guess passwords or try to exploit anything. Ports aren't checked at all when the site is behind a CDN such as Cloudflare, because the CDN isn't your server.
Is this a penetration test?
No. A penetration test tries to break in, by agreement, and goes much deeper. This is the outside view only: the things an attacker's scanner would notice first.
What doesn't it see?
Anything behind the login or on the server itself: patching of packages that don't show a version, who has access, backups, logs and alerts. Those are what the GUARD review covers.
What happens to the results?
The report is kept for 30 days so its link works, then deleted. The domain and the counts are kept as a record of checks. Your email is only kept if you give it, to reply to you.
The outside is only half of it.
The £250 GUARD review checks patching, access, backups and alerts from the inside, with the fixes in order. Book a call to start.