Free outside-in scan

Check your website and business email.

Type your website. We read the public records around it and show you what to fix first.

No login, password, software installation, or remote access is required.

Run the free checkup

Start with your website

The checkup is free and needs a free account. NHM may review the result and contact you about it. No passwords or private systems are accessed. See our privacy policy.

What the scan checks

Every check, by name.

The scan reads what any visitor or mail server can already see. It does not log in, install anything, or change your site. Eight areas, and the report says which of these passed and which did not.

Website and HTTPS

Whether visitors get a warning before they get your page.

  • HTTPS connection
  • HTTP to HTTPS redirect
  • HSTS max-age
  • HSTS subdomains
  • Mixed content
  • Response time
  • HTTP status

Security headers

Nine browser protections your site can switch on for free.

  • HSTS
  • Content-Security-Policy
  • X-Frame-Options
  • X-Content-Type-Options
  • Referrer-Policy
  • Permissions-Policy
  • COOP
  • CORP
  • X-XSS-Protection

Email authentication

Whether someone can send mail as you, and whether yours lands.

  • SPF
  • DKIM
  • DMARC
  • MX records
  • MTA-STS
  • TLS reporting
  • SPF lookup count
  • SPF policy strength

Exposed files

Files that should never be reachable from the internet.

  • .env files
  • Git folders
  • Backups
  • CI configs
  • Debug pages

Domain registration

An expired domain takes the website and the email down together.

  • Expiry date
  • Registrar
  • Domain age
  • Web host

DNS and reputation

A DNS problem interrupts both; a blacklist sends your mail to spam.

  • Nameservers
  • Nameserver redundancy
  • IP blacklists (DNSBL)

Technology and cookies

What your site tells the world it runs, and how it handles sessions.

  • Tech stack
  • Server version exposure
  • Framework exposure
  • Cookie Secure
  • HttpOnly
  • SameSite

Attack surface

Other names on your domain, found in public certificate logs.

  • Subdomains (Certificate Transparency)

A clean result is a good start, not a security assessment. Computers, accounts, backups and private systems need a separate review.

Ask about a full assessment

After the free checkup

What you can scan with an account.

The checkup on this page is the smallest thing DomainGuard does. A free account keeps the report, opens the deeper scans, and runs on your phone.

This page

The free checkup

  • One domain at a time
  • The eight areas above
  • A plain-English list of what to fix first
Free, no card

In the app or on the web

A free DomainGuard account

  • Every domain you own, checked whenever you press scan, with the results kept
  • A deeper website scan once you prove you own the domain: known vulnerabilities, exposed services, and the software your site runs
  • An alert when CISA or the NVD publishes a vulnerability for software found on your sites
  • One email address watched for dark-web breaches, re-checked on a schedule
  • Push alerts on your phone when a scan finishes or a breach lists your email
Create a free account

Paid plans from $6.99 a month

Watched for you

  • 25 to unlimited domains re-checked daily without you asking
  • Alerts for an expiring certificate, a changed DNS record, or a site that stopped answering
  • Scheduled vulnerability scans and DMARC reports showing who sends mail as you
  • SEO and accessibility scans, and more monitored email addresses
Compare plans