How secure is your website?
14 automated checks of your website, server and email protection – passive, like a normal visitor. In about a minute you see your grade, every finding and the ready-made fix for your IT.
-
Detectable CMS / visible versionUrgentWhat to do: Update WordPress and plugins, enable automatic updates, remove the version information.
-
Security headersImprove
-
TLS certificate & encryptionOK
The report is free. Staying on top of it is the package.
Free with an account
- Overall grade and traffic light for each check
- All findings with a ready-made fix for nginx, Apache, IIS, WordPress and Cloudflare
- Re-check fixed issues one by one, share the report with your IT
- Security certificate as a PDF (e.g. for cyber insurance)
Package only
- Continuous monitoring with alerts when things get worse
- Deep scan with your authorisation
- Several domains and a monthly report
- Data breach monitoring and security awareness, depending on the package
What our scanner does – and what it does not
Transparency matters to us. Here we explain how our security check works. If you reached this page via our scanner contact: our checks are non-intrusive and do not attack any systems.
Free instant check (passive)
We only evaluate publicly available information – just as any browser does. No access controls are touched and no load is generated.
- Secure cookies
- Security headers
- Detectable CMS / visible version
- Internal paths in robots.txt
- Email spoofing protection (DMARC)
- Email spam protection (SPF)
- Visible software versions
- Security contact (security.txt)
- Server software with known vulnerabilities
- Outdated libraries with known vulnerabilities
- HTTPS reachable
- TLS certificate & encryption
- Content embedded without encryption
- Redirect to HTTPS
Deep scan (only with your authorisation)
We only carry out more active checks for domains whose owner has expressly given us permission. This keeps everything legally sound (Sections 202a et seq. of the German Criminal Code).
- Path traversal / LFI
- Reflected cross-site scripting (XSS)
- SQL injection (error-based)
- CORS access for foreign origins
- Allowed HTTP methods
- Open redirect
- Reachable login and admin areas
- Publicly accessible sensitive files
- Open directory listings
See what you get before you start
A complete report for a fictitious sample company: overall grade, traffic light for each check, clear explanations and ready-made fixes for nginx, Apache, IIS, WordPress and Cloudflare – click through it, no sign-up required.
View sample reportQuestions about the Website Check
Is the Website Check really free?
Yes. You create a free account and see the complete report: overall grade, all findings and a ready-made fix for each one. The security certificate as a PDF is included too. We don't need any payment details for this.
What does a package add?
The free check is a snapshot. With a package we check your domains continuously, report any deterioration immediately, send a monthly report and run the deep scan with your authorisation. Depending on the package, data breach monitoring and security awareness for your team are added.
Does the check attack my website?
No. The basic check only reads what any browser can see and creates no noticeable load. More active checks run exclusively in the deep scan and only after your explicit, logged authorisation.
How often can I check for free?
Each website once every 24 hours. Individual issues you have fixed can be re-checked directly in your customer area.
Not sure where you stand?
Start with the free Website & Server Check – results in about a minute, no payment details required.