FREE TOOL — NO SIGNUP
Is My Website Exposed?
Type your website’s address and get a plain-English report card on what it shows the world: its security certificate, the software it advertises, its browser safety settings, how easily your email can be faked, and when your domain is due for renewal.
🔒 To check your site, our server visits your homepage the same way any visitor would. We don’t save the address you enter or the results.
Exactly what happens: our server loads your homepage over https the way a browser does (following any forwards, on the standard web ports only) and checks whether the plain http:// address forwards to it (following at most one more plain http:// forward on your own domain). If your https address doesn’t load, it may also load the secure address that forward points to on your own domain, the same way. It also asks for the standard security.txt contact file and reads your domain’s public DNS and registration records. It identifies itself as “ThouShaltNotClick-SiteCheck,” so your web host can see who visited. No logins, no scanning, nothing that would look like an attack. The address and the results never go into a database or our logs — a result is held in memory for up to an hour so repeat checks don’t bother your site, then it’s gone.
What we check
Secure connection (HTTPS)
Whether your site uses https with a valid certificate, when that certificate expires, and whether plain http:// visits are sent to the secure version.
Software your site advertises
Whether your site announces the software and versions it runs (like PHP 7.4 or WordPress 6.4) — and whether those versions still get security fixes.
Protective service in front of your site
Whether a content delivery network or web firewall sits in front of your site to soak up attacks.
Browser safety settings
Five standard settings that tell visitors’ browsers to block common tricks.
Email spoofing protection
Whether your domain’s email settings stop strangers from sending email that looks like it came from you.
Domain renewal
When your domain’s registration is due. A domain that lapses can be bought by someone else.
Security contact file
Whether your site tells people how to report a security problem they find (a security.txt file).
What we never do
We don’t scan for open ports, try to log in, look for hidden pages, or send anything that would look like an attack. We only look at what any visitor’s browser can already see. A clean result means we didn’t see these common problems from the outside — it isn’t a guarantee.
Related free tools
Your website is one way in. Email is the other.
ThouShaltNotClick trains your staff to spot phishing emails and puts a trust badge on every message in Gmail and Outlook.