HTTPS and your certificate
Whether your site loads securely, your certificate is trusted and in date, visitors are moved from http:// to https:// and your encryption is up to date.
Cyber Security
Free website security check
Find out how well your website is protected in under two minutes. Enter your web address and we'll email you a free report with a grade, what we found and simple steps to fix each issue yourself.
- SSL, HTTPS and security headers
- Email spoofing protection (SPF and DMARC)
- Out-of-date software and signs of hacked code
- Plain English fixes you can do yourself
What's included
What we check
Security headers
The browser settings that protect visitors from injected scripts, clickjacking and data leaks, including HSTS, Content-Security-Policy and X-Frame-Options.
Email spoofing protection
Whether your SPF and DMARC records stop criminals sending convincing fake emails that look like they come from your business.
Out-of-date software
Visible WordPress versions, old JavaScript libraries and servers that advertise exactly what they run, which attackers use to pick targets.
Signs of hacked code
Common fingerprints of malicious code on your homepage, such as hidden frames, obfuscated scripts and crypto-mining code.
Mixed content and cookies
Insecure files loaded on secure pages, and cookies that aren't protected from being read or sent over unencrypted connections.
The detail
Why check your website's security?
Most attacks on small business websites aren't personal. Automated tools scan the internet around the clock, looking for out-of-date software, missing protections and domains that can be used to send fake emails. A few simple settings stop most of them.
Your report explains each result in plain English and gives you the exact steps to fix it, whether you do it yourself, pass it to your web developer or ask us.
Want a deeper look?
This free check covers the essentials anyone can see from outside. If you handle customer data, take payments online or need evidence of security for insurance or customers, a penetration test goes much further, and our managed cyber security service keeps an eye on things all year round.
Questions
Common questions
Is it really free?
Yes. There's no charge and no catch. You'll get your report by email, and we won't add you to a mailing list. If you'd like help fixing anything, you can reply to the report, but there's no obligation.
Will the check affect my website?
No. It's completely passive. We load your homepage once, the same way a visitor's browser would, read your SSL certificate and look up your public DNS records. Nothing is attacked, guessed or changed.
How long does it take?
Your report usually arrives within a couple of minutes. If it doesn't, check your spam or junk folder.
Is this the same as a penetration test?
No. This is a quick, automated health check of what your website shows publicly. It doesn't scan the files on your server for malware or try to break in. For a thorough, hands-on test by our security team, see our penetration testing service.
Why do I need to confirm I own the website?
The report is meant for the people responsible for a website. Please only check sites you own or look after, such as your own business site or a client's site you manage.
What happens to my details?
We use your email address to send the report and keep a copy so we know who asked. We don't sell it or use it for marketing. See our privacy policy for full details.
Works well with