How secure is your website?

What is checked?

We only look at what any visitor of your website sees, at the public DNS data of your domain and at public sources: the logs of issued certificates and the domain registry. For each point the report says what we saw, what it means and who can fix it.

• Email and Microsoft 365

  We look at your MX, SPF, DKIM and DMARC records: the settings that decide whether others can send mail in the name of your domain, and whether your mail arrives instead of landing in spam. If you use Microsoft 365, we also look at the DKIM keys of Microsoft.

• Encrypted connection (TLS)

  We look at whether your website is reachable over https, whether the certificate is valid and when it expires, which TLS version the connection uses, and whether http redirects to https.

• Security headers

  We look at the instructions your website gives to browsers, such as Content-Security-Policy, HSTS, Referrer-Policy and the setting that stops other sites from embedding your pages.

• DNS

  We look at DNSSEC, CAA, MTA-STS and TLS-RPT, and whether there is a security.txt with a contact address for reports.

• Subdomains and domain registration

  We search the public logs of issued certificates for subdomains of your domain. Using DNS only, we check whether a subdomain still points to a service you no longer use, so that someone else could take over that name; we do not visit the subdomains themselves. At the domain registry we look at when your domain expires and whether the lock against transfers is on. We do not read or keep data about the holder.

• Similar domain names

  Using DNS only, we check whether domain names that look very much like yours are registered, such as one letter different or another extension, and whether they can receive email. We do not visit those domains, and we do not know who owns them: it may be you. So you know which senders your staff can look out for.

• Privacy indicators

  We load your home page once, without clicking anything. We look at which cookies are set before a visitor has made a choice, which connections go to known trackers, whether there is a cookie banner and whether there is a link to a privacy statement. We also look at whether fonts from Google Fonts, videos or maps load before a choice is made, and whether the parties behind those services are established outside the European Economic Area. This is a technical observation, not a legal judgement.

• Business details on the home page

  We look at whether your home page shows a Chamber of Commerce (KVK) number, contact details, an address and a VAT number. We only look at the home page: if the details are on another page, we do not see them, and the report says so.

• Visible software

  We look at which software and versions your website shows by itself, such as WordPress, the web server or PHP. If the version of WordPress or of a JavaScript library is exactly visible and that version has known vulnerabilities, we name them, with the advice to check whether your hosting has patched them. For the web server and PHP we only report that the version is visible: Linux distributions often apply security updates without changing the version number.

• Accessibility, outside the score

  We check the home page automatically with axe-core against the rules of WCAG 2.1 level A and AA. This is in a separate chapter and does not count towards the score. An automatic check finds only part of the problems; it is a first impression, not a judgement on the accessibility of your website.

How does it work?

1. 1You enter your domain. We check straight away whether we can scan it.
2. 2You confirm that you are authorised, enter your company details and pay.
3. 3Within minutes the report is in your mailbox, as a PDF to forward.
4. 4You book a conversation about the report within 60 days and get the full amount back after the call.

Sample report

The report is a PDF in Dutch or English. This is what is in it:

• A short summary and the five most important actions, each with who can fix it: your web developer or hosting, the administrator of your email or Microsoft 365, the administrator of your DNS, or yourself.
• An indicative score with the coverage per part: how much we could measure reliably.
• The results per part: what we saw, what it means, how to fix it and where you can check it.
• A checklist per party that you can forward.
• At a rescan: what has changed since the previous scan, and which points are still open.
• The limitations of the scan and the next step.

Download the sample report (PDF)

What the scan is and is not

• We only see what any visitor sees. We never log in, never fill in forms and never try out vulnerabilities.
• The report is a snapshot: this is how your website and your domain looked at the moment of the scan.
• If a point says "Unknown", that means: we could not measure it reliably. It says nothing about how things stand.
• A web developer or IT partner can check every point: each finding comes with the evidence and a public source.
• It is not a penetration test and not a security audit. If you want to look further, we discuss that in the conversation.

Frequently asked questions

Payment

You pay with iDEAL or another method through Mollie. You receive an invoice from AxonHub, the invoicing system of Axon Factory. Business only: you order with a Dutch Chamber of Commerce (KVK) number.