Audit my website security
A wider pass than the headers check: TLS version and certificate expiry, DNS hygiene (SPF, DMARC, DNSSEC, dangling CNAMEs), exposed admin and backup paths, directory listings, outdated frameworks announced in headers, and the security headers themselves. Everything is read from the outside; nothing is probed aggressively.
Any public page. Try .
What to do about it
The check found it. These are the ways to fix it, keep it fixed, or run the same check for every business you serve.
TagFrog Pro
Server-side tracking, consent and every ad platform API, proven with a real test order and kept current. Watch included when it launches.
See TagFrog ProWatch
Re-runs this check every week and emails you the moment the answer changes: site down, tag gone, score dropped, certificate expiring.
Join the waitlistWebsite
No website yet? $499, live in two days, or rebuild a tired one for the same price. Hosting and TagFrog on from day one, Watch when it launches, changes by chat, never a call. Have an agency? They can resell this.
Get online, $499OpsBlu
This same check, run for every local business in a territory. Leads with a reason to call, as CSV, API and MCP.
Go to opsblu.comWhat we check
- TLS protocol versions and certificate expiry date
- Certificate chain and hostname match
- HTTP to HTTPS redirect
- SPF, DKIM selector hints and DMARC on the domain
- Common exposed paths: /.git, /.env, /wp-admin, /backup, /phpinfo.php
- Directory listing enabled
- Software versions leaked in headers and HTML
- Security headers grade
Cost of one run: TLS + headers + DNS, a few requests. Results for the same URL are kept for a few minutes, so running twice is free and instant.
Questions
Is this a penetration test?
No. It reads what any visitor can see: certificate, headers, DNS records and a short list of well-known paths. It does not try to log in, inject anything or load the server. It finds the mistakes that get small sites compromised in bulk.
My certificate expires in 20 days. Is that a problem?
Only if nothing renews it. Let's Encrypt certificates last 90 days and renew automatically; a date under 30 days away usually means the renewal is working. Under 7 days, check it.
Why does the audit care about SPF and DMARC?
Without them anyone can send email as your domain. Your invoices land in spam and a phisher can impersonate you to your own customers. Both are one DNS record each.