Check any website in seconds
Security, certificates, DNS and email in one free report: about 30 checks, graded A+ to F, with a plain-English fix for every issue. No sign-up.
Complete the verification to run the check
What Web Check looks at
Five areas attackers, browsers and mail servers judge you on, checked from the outside the way they see you.
HTTPS & TLS
- Certificate trust, hostname and expiry
- TLS 1.0 to 1.3 support
- HTTP to HTTPS redirect
- HSTS strength and preload eligibility
Security headers
- Content Security Policy quality
- Clickjacking and MIME-sniffing protection
- Cookie Secure, HttpOnly and SameSite flags
- Software versions leaked, CDN and WAF in front
DNS & domain
- DNSSEC chain, including a missing DS record
- CAA certificate-authority lock
- Nameserver redundancy and IPv6
- Domain expiry and registrar transfer lock
Email security
- SPF validity and the 10-lookup limit
- DMARC policy and reporting
- DKIM keys on common selectors
- MTA-STS, TLS-RPT and BIMI
Website hygiene
- security.txt (RFC 9116)
- robots.txt and XML sitemap
- Mixed content on the homepage
- Server response time
Want the shorter version with an emailed grade? Try the 60-second security check
Frequently asked questions
Is the website check free?
Yes. Run as many checks as you like, on your own site or a supplier's. You see the full results on screen straight away, with no sign-up. Leaving your email is optional and only needed if you want the report sent to you.
Is it safe to run against a live website?
Yes. It is a passive outside-in check: a few ordinary HTTPS requests, TLS handshakes and public DNS lookups, the same traffic a browser or mail server generates. It never logs in, submits forms, or sends attack payloads.
How is the grade calculated?
Each check is weighted by severity (high, medium or low). A pass earns full points, a warning half, a failure none. Informational items, such as IPv6 or BIMI, are shown but not scored. 97 and above is A+, 90 is A, 80 is B, 65 is C, 50 is D, and anything lower is F.
How is this different from a penetration test?
This check only sees what anyone on the internet can see from outside. A penetration test goes inside: it tests the application logic, logins, APIs, cloud accounts and internal network the way a real attacker would. Most serious findings come from there.
Can RHC fix what the check finds?
Yes. Most findings are configuration changes we make in hours, at the web server, CDN, DNS provider or mail platform. Book a free 30-minute call and we will go through the report with you and quote the work.