Free Basic Security Scan

Website Security Checker

Check your website security in seconds: SSL/TLS, HTTPS redirect, security headers, DNS, SPF and DMARC — one passive scan and a clear security score.

30 free scans per month

Example: — domain only, no http:// or paths.
0 out of 100
Security Score

Check results

The main result of each of the six checks.

What should I fix?

Generated from the FAIL and WARNING results above, ordered by how many points each fix is worth.

All technical results and recommendations are included in the Detailed Security Report (PDF).

How your score was calculated

Every point is tied to a specific criterion. SSL/TLS 25 · HTTPS/Redirect 10 · Security Headers 30 · SPF 15 · DMARC 20. DNS is informational and not scored.

Threat Intelligence

Check whether an IP address, domain or file hash is linked to known malicious activity: the indicator is looked up in CyberCheckNow's threat database.

  • IP address (IPv4, IPv6)
  • Domain
  • File hash (SHA-256, SHA-1, MD5)
  • Free not included
  • Pro 1000 lookups per month
  • Business 10000 lookups per month

A reputation lookup in our own database of indicators from verified sources, not an antivirus scan: “not listed” does not mean that an indicator is safe.

What the website security scanner checks

Six passive checks in one scan: an SSL checker for your certificate and TLS, a security headers checker, SPF and a DMARC checker for your domain's email, plus HTTPS redirect and DNS checks. No sign-up, results in seconds.

For website owners, developers and IT administrators who want a quick outside-in baseline of their site's public security configuration. Every result explains what was found, and the recommendations show what to fix first.

SSL/TLS

We verify that your SSL certificate is trusted, matches your domain and is not about to expire, and that a modern TLS version (1.2+) is used.

HTTPS Redirects

We check that your site is reachable over HTTPS and that visitors who open the plain http:// address are redirected to the secure version.

Security Headers

We check HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy — browser protections against clickjacking, XSS and data leaks.

SPF

We read your SPF record to see which servers may send email for your domain and whether unauthorized senders are rejected.

DMARC

We check your DMARC policy, which tells receiving mail servers what to do with messages that fail authentication — the main defence against email spoofing.

DNS

We check that your domain resolves and has name server and mail records. DNS is informational and does not affect the score.

How the website security score works

Your website security score is the sum of five weighted categories — 100 points in total. Every point is tied to a specific criterion.

85 or more is rated Good, 60–84 Needs improvement and below 60 Poor.

Free tools and resources

Domain Lookup

Registrar, expiry date, registry status and name servers of a domain.

IP WHOIS

Who an IP address block is registered to: network range, organisation, ASN and abuse contact.

Pricing

Deep Scan reports, PDF reports and website monitoring plans.

API docs

Run website security scans from your own scripts with an API key.

Support

Questions about a result, your account or a report.

Frequently Asked Questions

What is a website security check?

A website security check looks at your site from the outside, the way a visitor or an attacker would: the SSL/TLS certificate, HTTPS redirects, browser security headers and the SPF and DMARC records that protect your domain's email. CyberCheckNow runs these checks for free and sums them up in one score.

What is a good website security score?

A score of 85 or more out of 100 is rated Good; 90 or more earns an A grade and 95 or more an A+. Scores from 60 to 84 need improvement, and anything below 60 is poor. The results list shows which fixes add the most points.

Why are security headers important?

Security headers tell the browser how to protect your visitors. HSTS forces HTTPS, Content-Security-Policy limits cross-site scripting (XSS), X-Frame-Options blocks clickjacking, and other headers stop MIME sniffing and data leaks. They are free to add and are configured on your web server or CDN.

What is SPF?

SPF (Sender Policy Framework) is a DNS TXT record that lists the servers allowed to send email for your domain. Receiving mail servers use it to detect forged senders; a strict SPF record ends with -all or ~all.

What is DMARC?

DMARC is a DNS record that tells receiving mail servers what to do with email that fails SPF or DKIM checks: deliver it, quarantine it or reject it. A quarantine or reject policy protects your domain from being used in phishing and spoofing.

Does CyberCheckNow perform intrusive scans?

No. The free basic scan is fully passive: it performs DNS lookups, one TLS handshake and a few ordinary HTTP GET requests — the same as a normal visitor. It does no port scanning, no vulnerability probing and no login attempts. The paid Deep Scan's port scan and active checks run only after you verify that you own the domain.

Is this website security test free?

Yes. The basic passive scan — SSL/TLS, HTTPS redirect, security headers, DNS, SPF and DMARC with a 0–100 score — is free and needs no sign-up. The optional Detailed Security Report is a one-time $4.99 purchase and adds Deep Scan, detailed Fix Guides and a PDF report.

Is this a full website security audit?

No. The free scan is a passive, outside-in check of your public configuration — it is not a penetration test and not a full security audit. It does not test your application code, log in, scan ports or probe for vulnerabilities. Use it as a fast baseline and add a professional audit or penetration test when you need one.