How are your domain's security settings doing?
Why this check does not look for vulnerabilities
You will not find a button here that probes a site for weaknesses. That is a deliberate choice, and it is fairer to explain it than to leave it unsaid.
What this tool does
- Query DNS records (SPF, DMARC, DKIM, DNSSEC) — this does not even touch your server
- Open one secure connection to read the certificate
- Request your page once, the way any visitor does
- Check once whether the unencrypted address redirects properly
- Read what is in that one page: cookies, forms, loaded code
- Assess what comes out of that, and explain it
What this tool deliberately does not do
- Scan ports or map networks
- Hunt for forgotten files such as backups or configuration files
- Click beyond that one page, or fill in forms to see what happens
- Try whether a weakness can actually be exploited
Everything we measure can be measured by anyone with a browser and two standard commands; we do it in one go and translate it. That is something else than building tooling to probe an arbitrary site. Such a tool does not know who is operating it: to the button, there is no difference between checking your own site and checking someone else's. Anyone wanting a real vulnerability assessment should have it carried out on a site they own, by someone given permission in advance. That is precisely the difference between a test and an attack, and it is not a detail you leave to a web form.
Want to go further than this check? Internet.nl is the official Dutch test for modern internet standards, and for a genuine security assessment you engage a party that works with you on your own environment.
Most of a domain's security settings are invisible: they live in DNS and in the response your server sends along. You only notice something is missing when it goes wrong — a certificate expiring on a Sunday morning, or a customer calling about an invoice you never sent. This check reads those settings and explains in plain language what is there, what it means and what you can do about it.
What people use this for
- See whether someone can send mail that appears to come from your domain (SPF and DMARC)
- See which parties may currently mail on your behalf — and whether you still use them all
- See which external parties run code on your page — and whether that code is verified
- Check how many days your certificate is still valid and whether renewal works
- See whether your certificate also covers the address with www — a classic cause of warnings
- Find out whether your server hands its own version number to everyone
- Get a list you can forward as-is to your hosting provider or web developer
What others think of this tool
No reviews for this tool yet. Yours would be the first.
Do you work with Westcube?
Leave a review on Google tooFrequently asked questions
Is this a security test or a hacking attempt?
Neither. We ask a number of DNS questions about your domain — which does not even touch your server — open one secure connection to read your certificate, and request your page once, exactly as an ordinary visitor does. Nothing is probed, nothing is attempted and nothing is searched. See the section "Why this check does not look for vulnerabilities" above.
May I use this to check someone else's site?
Yes, because nothing happens that an ordinary visitor would not also do: request one page and look at the certificate. The result is therefore public information. What you do with that information is a different question — and that one is yours.
What does it mean when it says someone can send mail on behalf of my domain?
That your domain name can be placed in the sender of an email without the recipient seeing the difference. That is the mechanism behind invoice fraud: a message that appears to come from your finance department, with a changed bank account number. Three DNS records — SPF, DKIM and DMARC — largely close this. Your hosting provider or mail provider can set them up for you; it costs no licence and no subscription.
Why is there no score or grade?
Because any weighting we chose would be arbitrary. Is a missing Content Security Policy worse than a certificate expiring in two weeks? That depends entirely on your situation. A grade also invites optimising for the grade rather than for your visitors. So you get an ordered list instead: what is broken at the top, what is fine at the bottom.
My site scores poorly. How bad is that?
It depends on what is missing. An expired certificate is an outage you notice today. A missing Permissions-Policy is a refinement you can leave for months. That is why every finding comes with an explanation of what it means in practice — the order of the list is already a prioritisation.
Can I forward the result to my web developer?
That is what it is built for. The findings are phrased so that someone without a technical background can forward them and someone with one immediately knows what to do. Most points name the setting involved, so the recipient does not have to guess.
Why don't you check whether TLS 1.0 is still enabled?
Because we cannot make that measurement reliably. Our own server refuses those outdated versions before we can even try them, so we would report 'disabled' while not actually knowing. A measurement that can silently turn into false reassurance is worse than no measurement — certainly in a tool people draw comfort from.