Scan Your Website Security
Get a security grade for your website, with a plain-English list of what to fix and why it matters
Why Website Security Matters
Customer Trust
84% of consumers say they would abandon a purchase if data was sent over an insecure connection. Security badges and HTTPS are now expected by users and directly impact conversion rates.
SEO Impact
Google has confirmed HTTPS as a ranking signal since 2014. Insecure sites display "Not Secure" warnings in browsers, deterring visitors and signaling poor quality to search engines.
Email Impersonation
Fake invoices and payment requests sent "from" a real business are one of the costliest scams small businesses face. SPF and DMARC records tell inboxes to reject email that pretends to be you.
Financial Protection
The average cost of a data breach in 2024 is $4.88 million. Small businesses are increasingly targeted - 43% of cyberattacks target small businesses, with 60% going out of business within 6 months.
What Our Security Scanner Checks
Your site gets an A+ to F grade on the same scale as Mozilla's HTTP Observatory, plus a separate rating for email spoofing protection.
Encryption (HTTPS)
A valid, unexpired SSL certificate, old TLS 1.0 and 1.1 switched off (we test each version), http:// sending visitors to https://, HSTS, and no insecure content on secure pages.
Browser protections
Security headers judged by their actual settings, not just whether they exist: Content Security Policy quality, clickjacking protection, file-type sniffing, referrer policy, cookie flags and script integrity checks.
Malware and blocklists
Known malware and card-skimmer signatures on your page and its scripts, scripts loaded from newly registered domains, and public malware blocklists.
Software and exposed files
Outdated WordPress, plugins and JavaScript libraries, unsupported PHP, and files that should never be public, like .env, .git and backups of wp-config.php. We only report that a file is exposed, never its contents.
Email spoofing protection
SPF, DMARC (policy and coverage) and DKIM, which decide whether scammers can send email that looks like it came from you.
Common Security Vulnerabilities
- Missing HTTPS - Data transmitted in plain text can be intercepted
- Outdated software - WordPress, plugins, and themes with known vulnerabilities
- Missing security headers - No protection against injected scripts and clickjacking
- No DMARC record - Scammers can send email that looks like it came from your business
- Exposed files - Backup and settings files left public can leak passwords
Need Help Securing Your Website?
Our team can help implement security measures and protect your website from threats
Get Security Help