How exposed is your website?
Most small-business sites are missing basic protections that take minutes to add. Enter your website and get a graded report of its security headers, HTTPS setup, cookies and outdated scripts, with a plain-English fix for each one.
Passive only: I load your homepage like a normal visitor and read the response. No attacks, no logins, no guessing at hidden files. Nothing is stored.
Also free: can ChatGPT find your business?
See what ChatGPT, Claude and Gemini can read about your business, and what's stopping them from recommending you.
Questions
Is it safe to run this on my site?
Yes. It makes the same few requests a normal visitor's browser makes: the homepage over HTTPS and HTTP, and /.well-known/security.txt. It never submits forms, logs in, sends payloads or probes for hidden files.
If I score an A, am I secure?
No. An A means your browser-level protections are in place. Most real breaches come from application logic: broken access control, weak authentication, insecure file uploads and exposed APIs. Only a hands-on review finds those.
Can I scan a site I don't own?
The scan only reads what every visitor's browser already receives, so it's harmless, but please use it on your own sites or ones you manage.
Do you store the results?
No. Results are cached for 15 minutes, then discarded. Only if you fill in the form do I get your email and the results.