Website security tools

Every tool here runs real checks. The four free checks need no account. They all run the same external scan and highlight a different part of it. The monitoring tools work on domains you've proved you own.

Free checks, no account needed

  • Free · no account

    Website security check

    All 27 external checks in one pass: HTTPS and redirects, TLS certificates, security headers, DNS, email authentication and homepage content, with a Site Health score and a prioritized fix list.

    Run the website security check
  • Free · no account

    SSL/TLS certificate check

    Certificate expiry, hostname coverage, the certificate chain, and whether TLS 1.0 or 1.1 is still accepted, with the certificate details as evidence.

    Check a certificate
  • Free · no account

    Security headers check

    HTTPS enforcement, HSTS, Content Security Policy, clickjacking protection, MIME-sniffing protection, Referrer-Policy, Permissions-Policy and cookie flags.

    Check security headers
  • Free · no account

    Email security check

    MX, SPF and its 10-lookup limit, DMARC, DKIM for a selector you supply, MTA-STS and TLS reporting, with safe, step-by-step fixes.

    Check email security

For domains you own

These are in the free monitoring beta (one domain per account). Each needs proof that you control the domain, by a DNS TXT record or a file on the site.

  • Scheduled monitoring and alerts

    The full check on a schedule, 90 days of history, homepage malware and cloaking indicators, a weekly check of up to 10 subdomains and 5 key pages, and alerts to Slack, Discord or a webhook.

    Open the dashboard

  • Server agent

    Runs on your own server: core integrity for WordPress, Joomla and Drupal, PHP files in upload folders, malware patterns, a read-only WordPress database scan, and cleanup you approve, with undo.

    Read about the server agent

  • Vulnerability matching

    Versions reported by the agent are matched against Wordfence Intelligence (WordPress), OSV.dev and the NVD (Drupal, Joomla). A version guessed from the outside is never used.

    Open the dashboard

  • Cloudflare settings review

    Review SSL mode, HTTPS redirects and firewall settings in your own Cloudflare account, apply the changes you choose and revert them. The API token is used once and never stored.

    Open the dashboard

Which tool should I use?

Start with the website security check: it runs everything and tells you where to begin. Use a focused page when you're working on one area and want the explanation that goes with it.

The free checks only use information anyone can see from outside, so they can't find malware or problems inside your server. If you run the site, verify it in the dashboard for scheduled checks, and install the server agent to look at files and the database. What we check lists every check and its limits.