What would an attacker see if they looked at this site today? Safe to run on any site you own or are authorised to test: it only looks, it never touches anything.
-0/100
Overall grade
Security-
Accessibility-WCAG 2.1 (indicative)
SEO-metadata and crawlability
Best practices-responsive and rendering
Turn this scan into an Essential Eight audit
Carries these findings and the email authentication check into the audit, fills in every answer they can prove, and marks the rest for a person.
Web-facing indicators mapped to the controls your auditors and insurer ask about.
What a website scan cannot tell you
How this score is calculated
Security findings
Enter a URL and press Start scan to see findings mapped to the Essential Eight.
Mermaid / UML Renderer
Paste Mermaid or UML code and render it to SVG. Everything happens in your browser: the code never leaves this page.
Diagram code
Preview
AWS Lab Checker
Finished a workshop lab? Pick your session, enter your resource details, and the checker inspects your real AWS resources with read-only calls and stamps each step pass or fail.
Read-only. The checker never creates, changes, or deletes anything in your account.
Checks not run yet
Breached Services
Type the domain of a service your firm relies on and see whether it has suffered a known data breach, when, and what kind of data leaked. Nothing about you or your clients is sent anywhere.
Listed under a different domain or only by name. Check these are the same organisation before acting on them.
Breach
Domain
Date
Accounts
Data exposed
Email Header Analyser
Paste the whole suspicious email, just its headers, or a forwarded copy, or drag the email file straight onto the box. It finds the headers itself and shows where the message really came from, whether it passed authentication, and the warning signs to look for. Processed in memory and never stored.
Drop an email file here, or
Best result: the original file. Outlook desktop: drag the email from your inbox list straight onto the box. Gmail: three dots menu, Download message, then drop the file here. A forwarded copy works too, but only shows what the forwarder chose to include.
Verdict
-
Authentication
-
Sent from
-
What to look at
Envelope
Route the message took, oldest first
#
From server
To server
IP
Time
Lookalike Domains
Has somebody already registered a domain that looks like this one? Generates the typos and swaps a scammer would use, then checks which ones exist and which can send email. Uses DNS only.
Checks around a hundred variations in a few seconds. Worth re-running every few months, since new registrations appear all the time.
Variations checked
0
Already registered
0
Set up for email
0
Registered lookalikes
Domain
How it differs
Resolves to
Email
A registered lookalike is not proof of intent. Some are defensive registrations by other firms, some are unrelated businesses. Ones with email set up deserve a closer look, because they can send an invoice in your name. Report abusive .au registrations to auDA, and others to the registrar shown in the Domain Registration tool.
Domain Registration
Could this domain be lost or taken without anyone noticing? Shows the expiry date, whether it is locked against transfer, and whether personal details are published in the registry. Read from the registry directly.
Checks
Registration record
SSL / TLS Checker
Is the padlock in a visitor's browser actually doing its job? Checks whether the certificate is current and the encryption settings are still considered safe.
Grade and certificate
B
Issuer-
Valid until-
Days remaining-
Protocols-
Configuration checks
DNS & Email Security
Can someone send email pretending to be this domain? Reads the three DNS records that decide the answer and tells you which are missing or too weak.
