Free · No password · Results in under a minute
Get your free security grade in 60 seconds
See your business the way attackers do. Enter your domain and get an A–F grade plus a short, plain-English fix list. Passive public checks only.
What we check
The public settings attackers look at first.
Email spoofing protection
SPF, DKIM and DMARC: can criminals send invoices that look like they came from you?
Mail setup
Who handles your email, and whether your domain is set up to receive it.
Website certificate
Is your HTTPS certificate valid, trusted, and not about to expire?
HTTPS everywhere
Do visitors always land on the secure version of your site (HTTPS + HSTS)?
Security headers
Standard browser protections against clickjacking and malicious scripts.
DNSSEC
Is your domain's DNS signed so attackers can't forge it?
A report you can actually act on
Every finding is written in plain English with the exact fix, an effort estimate, and what we saw. Hand it to your IT provider or fix the quick wins yourself.
Sample report. Your full report unlocks after a quick email sign-in.
Sample grade
yourbusiness.com
Some public settings make you easier to target.
- DMARC (email spoofing protection)Fail
- SPF (approved email senders)Pass
- Website certificate (TLS/SSL)Pass
- Website security headersNeeds attention
01
Enter your domain
Nothing to install or configure.
02
Confirm your email
One click on the link we send you. No password to create.
03
Get your grade + fixes
An A–F grade and a plain-English fix list, ranked by impact.
Questions
- Is this a hack or a scan of my network?
- No. We only do what any email server or web browser already does: public DNS lookups, a normal secure connection, and one request for your homepage. No port scanning, no login attempts, nothing intrusive.
- How is the grade calculated?
- It's a weighted score of the checks above. Email spoofing protection counts the most because fake-invoice and wire-fraud scams are the most common way small businesses lose money. One serious problem, like an expired certificate, caps the grade at D no matter how good the rest is.
- Why do I need to sign in?
- A quick email sign-in (no password) keeps the tool from being used to probe other people's domains anonymously. We log each scan (your email, IP address, the domain and the time) for abuse prevention, and we never publish results.
- Why does the sign-in email say “Reset your password”?
- Sign-in emails come from no-reply@netlify.com using Netlify's standard wording. First-time visitors get “Verify your email” with a “Confirm your email address” link; returning visitors get “Reset your password”. Either way there is no password: clicking the link just signs you in and opens your report. Check your spam folder if it doesn't arrive within a couple of minutes.
- What if I get a bad grade?
- Each finding comes with a plain-English fix, and most take about 15 minutes. If you'd rather have an expert walk you through it, book a free 30-minute assessment with a CogniGlide security engineer.
Rather talk to a human?
Book a free, no-obligation 30-minute security assessment. We'll review your setup and highlight the top risks you should address first.
Book Your Free Assessment