Website and HTTPS
Whether visitors get a warning before they get your page.
- HTTPS connection
- HTTP to HTTPS redirect
- HSTS max-age
- HSTS subdomains
- Mixed content
- Response time
- HTTP status
Free outside-in scan
Check your website and business email.
Type your website. We read the public records around it and show you what to fix first.
No login, password, software installation, or remote access is required.
Get the DomainGuard app
Add the domain you check here and the next checkup is one tap. iPhone and iPad, iOS 16 or later, free.
What the scan checks
Every check, by name.
The scan reads what any visitor or mail server can already see. It does not log in, install anything, or change your site. Eight areas, and the report says which of these passed and which did not.
Security headers
Nine browser protections your site can switch on for free.
- HSTS
- Content-Security-Policy
- X-Frame-Options
- X-Content-Type-Options
- Referrer-Policy
- Permissions-Policy
- COOP
- CORP
- X-XSS-Protection
Email authentication
Whether someone can send mail as you, and whether yours lands.
- SPF
- DKIM
- DMARC
- MX records
- MTA-STS
- TLS reporting
- SPF lookup count
- SPF policy strength
Exposed files
Files that should never be reachable from the internet.
- .env files
- Git folders
- Backups
- CI configs
- Debug pages
Domain registration
An expired domain takes the website and the email down together.
- Expiry date
- Registrar
- Domain age
- Web host
DNS and reputation
A DNS problem interrupts both; a blacklist sends your mail to spam.
- Nameservers
- Nameserver redundancy
- IP blacklists (DNSBL)
Technology and cookies
What your site tells the world it runs, and how it handles sessions.
- Tech stack
- Server version exposure
- Framework exposure
- Cookie Secure
- HttpOnly
- SameSite
Attack surface
Other names on your domain, found in public certificate logs.
- Subdomains (Certificate Transparency)
A clean result is a good start, not a security assessment. Computers, accounts, backups and private systems need a separate review.
Ask about a full assessmentAfter the free checkup
What you can scan with an account.
The checkup on this page is the smallest thing DomainGuard does. A free account keeps the report, opens the deeper scans, and runs on your phone.
This page
The free checkup
- One domain at a time
- The eight areas above
- A plain-English list of what to fix first
In the app or on the web
A free DomainGuard account
- Every domain you own, checked whenever you press scan, with the results kept
- A deeper website scan once you prove you own the domain: known vulnerabilities, exposed services, and the software your site runs
- An alert when CISA or the NVD publishes a vulnerability for software found on your sites
- One email address watched for dark-web breaches, re-checked on a schedule
- Push alerts on your phone when a scan finishes or a breach lists your email
Paid plans from $6.99 a month
Watched for you
- 25 to unlimited domains re-checked daily without you asking
- Alerts for an expiring certificate, a changed DNS record, or a site that stopped answering
- Scheduled vulnerability scans and DMARC reports showing who sends mail as you
- SEO and accessibility scans, and more monitored email addresses
DomainGuard for iPhone
Take the report with you.
Same account, same report. Add the domain you just checked and the next checkup is one tap. When a scan finishes or a breach lists your email, the app tells you.
- Requires
- iOS 16 or later, iPhone or iPad
- Cost
- Free, and the free plan is enough
- Account
- The same login as the web
- Today
- Installs through Apple TestFlight until the App Store release
