Know your company's security rating
Gain real-time visibility into your cybersecurity posture. Enter a domain to get a free A–F rating: email spoofing protection (SPF/DKIM/DMARC), SSL/TLS, website security headers, exposed ports and domains.
No sign-up · No attack traffic · Nothing intrusive
Three engines, one rating
Security rating
Email authentication, transport encryption, web baseline, DNS health, exposed ports and actively exploited vulnerabilities — scored on a transparent 100-point model.
Brand & threat intel
Look-alike and phishing domains, new certificates in CT logs, info-stealer infections and leaked credentials, negative news.
One-click fixes
Copy-paste configuration for your Nginx, Apache, IIS, Cloudflare or DNS provider — then re-test instantly.
Where your defenses falter, attackers strike first.
In cyber warfare, unseen blind spots are your biggest risk. Our security assessment replicates the attacker’s view in real time: if threat actors can detect your perimeter flaws, misconfigurations, or exposed assets, you should see them first. Close the gaps before they become breaches, and stop malicious attacks before they happen.
Built for
- SMBs and online stores without a security team: know what to fix first.
- MSPs and security consultants: multi-tenant, white-label reports, monthly monitoring you can resell.
Security Guides
View all →What Is a Website Security Score? How to Read an A–F Grade
How a domain security grade (A–F) is calculated across seven weighted areas — email spoofing defences, SSL/TLS, security headers, exposed ports, reputation, IP risk and DNS hygiene — plus how to run a free self-check.
Someone Is Sending Email as My Company: SPF, DKIM and DMARC Explained
Why attackers can impersonate your company by email, what SPF, DKIM and DMARC each prevent, how to check whether your own domain is being abused, and how to fix it.
How to Spot Look-alike and Phishing Domains (Typosquatting Guide)
How attackers register unipec.co or unipec-co.com style domains to phish your customers: spelling variants, homoglyphs, monitoring new registrations, and what to do once you find one.
What Is EASM? External Attack Surface Management & Free Scanner (2026)
What is External Attack Surface Management (EASM) in cybersecurity? Map open ports, forgotten subdomains & shadow IT — then run a free, no-signup EASM scan.
SSL/TLS Certificate Checks: Is a Site's Encryption Actually Safe?
How to check whether a website's SSL/TLS setup is sound: validity, issuer, protocol versions, known vulnerabilities such as Heartbleed and POODLE, and how to self-check for free.
Subdomain Takeover Explained: Dangling DNS & Free Check (2026)
How subdomain takeover works: an abandoned subdomain still points at a released cloud resource, an attacker claims it, and uses your domain for phishing, forged mail or malware — plus how to check your own domains.
Security Response Headers: HSTS, CSP and X-Frame-Options Explained
A practical guide to HTTP security headers: HSTS to force HTTPS, CSP against XSS, X-Frame-Options against clickjacking, X-Content-Type-Options against MIME sniffing — with configuration notes and how to verify them.
How to Read DMARC Reports: From p=none to p=reject
How to read DMARC aggregate (RUA) reports: who is sending as your domain, what passes SPF and DKIM, how to move from monitoring to p=quarantine and p=reject, and the mistakes that derail it.
What DNSSEC Does: Preventing DNS Hijacking and Cache Poisoning
How DNSSEC works and why it matters: what hijacking and cache poisoning look like without it, how to enable it, its limits, and why you should also publish a CAA record.
How to Assess a Vendor's Domain Security Risk: A Third-Party Checklist
A practical way to assess suppliers and partners using externally visible signals — email spoofing defenses, SSL, exposure and look-alike domains — with a self-assessment checklist and grading guidance.
Recently assessed domains
Every domain we scan gets a public report page: DNS hygiene, email spoofing defences (SPF/DKIM/DMARC), TLS certificate, HTTP security headers and exposed services — all from publicly observable information.
- Aunipecasia.com95/100
- Cdji.com71/100
- Bbochk.com84/100
- Bhsbc.com.hk89/100
- Cglencore.com75/100
- Bshopify.com80/100
FAQ
Will a scan affect my website?
No. The traffic is equivalent to a visitor opening your homepage a few times.
How is the score calculated?
Each issue deducts points by severity; the same issue across many assets is scaled, not repeated. Critical and high issues cap the grade. Every issue shows how many points fixing it is worth.
Can others look up my domain?
Anyone can see the rating overview (like SSL Labs, it uses public information only), but asset and leak details are only shown to users who verify domain ownership. Domain owners can also opt out of scanning.