What a Free Website Check Covers, and What It Misses

A free website check reads what your site and your domain show to the outside: the DNS records, the certificate, the response headers, the email-authentication records and how fast the page loads in a lab test. It cannot see inside your server, your plugins, your passwords or how your visitors really experience the site. Treat it as a smoke detector, not an inspection.

Here is what each part of such a check can and cannot tell you, with the standards behind it.

Everything on this list is public by design, which is why a tool can check it without logging in.

• Security headers. Headers such as Strict-Transport-Security (tells browsers to use only HTTPS) and Content-Security-Policy (limits what a page may load) are sent with every response. MDN documents both: Strict-Transport-Security and Content-Security-Policy. Mozilla's HTTP Observatory (2 July 2024) grades sites on this kind of header configuration.
• The certificate and TLS. Whether the site is served over HTTPS with a valid certificate. Certificates are also getting shorter-lived. The CA/Browser Forum adopted ballot SC081v3 (published 11 April 2025), and its Baseline Requirements (section 6.3.2) now set the maximum validity of subscriber certificates at 200 days from 15 March 2026 (down from 398), 100 days from 15 March 2027 and 47 days from 15 March 2029. The first step is already in effect. Renewal has to be automatic, because nobody renews every few weeks by hand.
• Email authentication. SPF, DKIM and DMARC records live in DNS. Google's email sender guidelines require authentication from all senders to Gmail, and for senders of more than 5,000 messages a day to Gmail accounts, since 1 February 2024, SPF, DKIM and DMARC together with one-click unsubscribe on marketing mail. Google also asks senders to keep the spam rate reported in Postmaster Tools below 0.10% and never reach 0.30%. DMARC itself now has a new specification: RFC 9989 is a Proposed Standard that obsoletes RFC 7489 and RFC 9091.
• Page speed in a lab. A lab test loads your page once, under fixed conditions, and measures it. Google's Core Web Vitals (last updated 31 October 2024) set the good thresholds at a Largest Contentful Paint within 2.5 seconds, an Interaction to Next Paint of 200 milliseconds or less and a Cumulative Layout Shift of 0.1 or less, measured at the 75th percentile of real page loads.

This is the part a score hides.

• Real visitors. A lab number is one load on one simulated device. The 75th-percentile thresholds above are about field data from real users, which a one-off scan does not have.
• Accessibility. The W3C's guidance on evaluation tools (updated 13 May 2024) says that tools cannot check every aspect automatically and that human judgement is required. A green automated result is not a conformance statement.
• What is behind the front door. The Observatory FAQ says it does not test for outdated software versions, SQL injection, vulnerable CMS plugins or how passwords are stored. No outside check sees those, so a clean header grade does not mean the site is secure.
• DKIM in full. A DKIM record sits under a name chosen by whoever sets up the mail service, and DNS offers no way to list those names. A scan can look for the names a known mail provider documents. If your provider is unknown to it, the honest answer is “could not check”, not “missing”. Our own scan reports it that way.
• A clean malware verdict. No list of risky sites is complete. Some risky sites are missing from any list, and some safe sites are listed in error, so a clean result is not a guarantee that a site is safe.

Use it to find the cheap, high-value fixes: missing email authentication, a missing HSTS header, a certificate that renews by hand. Then decide what needs a person: an accessibility review, a plugin and update audit, a look at real-user speed data. Our free website scan reads the outside signals above and says “could not check” where it cannot know. If something it shows needs fixing, security setup is where we do that.

1. Run a check on your domain and write down every item that says missing or failed, and every item that says it could not check.
2. Fix the email records first (SPF, DKIM, DMARC) if you send customer mail: that is the one with a published sender rule behind it.
3. Put certificate renewal on automatic, and ask whoever runs your site for the date of the last plugin and software update.

All pages below were read on 2026-10-07.

• Email sender guidelines, Google.
• RFC 9989, DMARC, IETF.
• Introducing the MDN HTTP Observatory, MDN, 2 July 2024.
• Observatory FAQ, MDN.
• Strict-Transport-Security, MDN.
• Content-Security-Policy, MDN.
• Web Vitals, web.dev, last updated 31 October 2024.
• Selecting Web Accessibility Evaluation Tools, W3C WAI, updated 13 May 2024.
• Ballot SC081v3, CA/Browser Forum, published 11 April 2025.
• Baseline Requirements, section 6.3.2, CA/Browser Forum.

• Free website scan
• Security setup for small businesses