Website security in plain language
Enter your website and get a free security report: what we found, how risky it is and what to do about it.
✓ free scan✓ no sign-up
What you get
Receiving mail servers get no instructions for forged email claiming to be from your domain, so spoofed messages are often delivered.
Fix → Add a TXT record at _dmarc.example-shop.com, e.g. "v=DMARC1; p=quarantine; rua=mailto:postmaster@example-shop.com". Start with p=none to monitor, then move to quarantine or reject.
xmlrpc.php is a common brute-force and amplification attack vector.
Fix → Disable XML-RPC if you do not use it (plugin or server rule).
Browsers remember the HTTPS-only rule for only 3600 s; a visitor returning later can be downgraded again. At least 6 months is recommended.
Fix → Raise it to: Strict-Transport-Security: max-age=31536000; includeSubDomains
See the full sample report (10 findings, step-by-step guides, page speed) →
Type your domain. The scan is free, usually takes under a minute, and checks the site from the outside without logging in or changing anything.
A graded list of findings, ranked by risk. Each one explains the problem and what to do, written for site owners, not just developers.
Most findings come with step-by-step instructions or a configuration example. If you would rather not do it yourself, email info@scanmend.com and we will take a look.
All checks run from the outside: nothing is installed or changed on your site.
HTTPS availability, HTTP→HTTPS redirects, redirect chains, SSL certificate expiry, mixed content.
HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy, including common configuration mistakes.
Tracking scripts (Google, Meta, Hotjar, TikTok…) without a visible consent banner, tracking cookies set before consent, Secure and HttpOnly cookie flags.
SPF, DMARC and common DKIM selectors (protection against email sent in your name), plus CAA (who may issue your SSL certificate).
Commonly forgotten files: .env, .git, database dumps, backup archives, old config files, phpinfo. Checked only when you confirm you own the site or have permission.
CISA KEV, NVD, OSV and WPScan lookups for the CMS, PHP, plugin and JavaScript versions we can see, with EPSS exploit forecasts where available.
Spam blocklists (SpamCop, Barracuda, Spamhaus), Google Safe Browsing, open ports on the server IP (Shodan) and subdomains listed in public certificate logs.
Optional Google Lighthouse audit: performance, accessibility, best practices and SEO — four separate scores.
| Free scan, no account needed | ✓ |
| Plain-language explanations (English and Lithuanian) | ✓ |
| Step-by-step fixes, with configuration examples where possible | ✓ |
| Help with the fixes | Email us |
Yes. The scan and the full report are free and need no account. We ask for an email address so we can send you the report; monitoring alerts are optional.
No. A scan is a few dozen ordinary page requests, like the ones a visitor's browser makes. We do not log in, submit forms or send attack payloads, and nothing is installed or changed on your site. See exactly what our scanner requests.
Some checks try to open files that should never be public (.env, backups, database dumps) and look for admin panels on subdomains. We run those only when you confirm you own the site or have permission to test it.
Anything behind a login or on the server itself: malware hidden in files, weak passwords, the database, software that leaves no trace in the page. It is not a penetration test. A good grade means the common outside mistakes are covered, not that the site cannot be hacked.
We use them to run the scan and send you the report. Scan records are kept for up to 12 months, shareable report links expire after 30 days, and we do not sell or share your data for marketing. Privacy policy.
Tick the box when you scan and confirm by email. We then rescan the site once a week and check every 15 minutes that the home page answers. You get an email when the grade drops or the site goes down, and every email has an unsubscribe link.
Most findings come with step-by-step instructions or a ready configuration example. If you would rather not do it yourself, email info@scanmend.com and we will take a look.