About the scan

We look only at public information: the same things any web browser or email server can see. We visit up to about 25 of your public web pages like a normal visitor. We never log in to anything, and this is not a penetration test.

What we check

How we grade

• Every site starts at 100 points.
• Each “Fix now” finding costs 15 points.
• Each “Improve” finding costs 5 points.
• No single area can cost more than 30 points. The four graded areas are Email, Website, Domain, Exposure.
• Optional suggestions, notes and website speed don't change the grade.

The grade comes from the points left:

• A90–100Strong. Just a few small things to keep an eye on.
• B80–89Good, with a few gaps worth closing.
• C70–79Fair. Some real gaps, and most are easy to fix.
• D60–69Needs attention. A few fixes would make a big difference.
• Funder 60At risk. Several basics are missing, but most are quick to fix.

The grade reflects public signals only. It can't see inside your email accounts, backups or passwords.

Exactly what requests we make

• DNS lookups through public resolvers (Cloudflare and Google): your email records (MX, SPF, DKIM, DMARC), your name servers, CAA and DNSSEC, and your website's addresses.
• One visit to your home page on https:// and http://, for the domain and its www form, following up to 3 redirects, plus a check of the website's security certificate.
• Up to 25 pages of your own site, or 60 seconds, whichever comes first, at most 2 at a time, honouring robots.txt.
• One request each to /.well-known/security.txt, /robots.txt, /wp-login.php, /wp-admin/, /administrator/, /user/login.
• Up to 30 links between your own pages are checked for errors (a HEAD request, then a GET only if the server refuses HEAD), honouring robots.txt.
• DNS lookups of up to 150 look-alike domain names (typos and other endings of yours), to see whether they are registered. They are never visited.
• Your domain's public registration record (RDAP), found through the IANA directory and read from your domain registry.
• Google's PageSpeed Insights visits your home page for the mobile and desktop speed tests; Google Web Risk is asked whether your home page's address is on its list of unsafe sites.
• No logins and no form posts, ever.

Every request to your site identifies itself with the User-Agent ElevateSecurityCheck/1.0 (+https://securityaudit.pro/about). Our requests come from Vercel's servers, which run on Amazon Web Services, so the source addresses are theirs.

Who we are

The check is run by Elevate IT Solutions, an IT company for small businesses. More about us at elevateitpro.com (opens in a new tab).

Opt out, or report abuse

If you own a domain and don't want us to check it, add it below or email security@elevateitpro.com. We stop checking it straight away. To report abuse of this service, email the same address.

Changed your mind? Opt back in