Enter your website's address. In about two minutes you get a grade and a plain-English list of what to fix first. We look at what a hacker sees before trying anything: how old your encryption is, whether your site tells browsers to protect your visitors, whether someone can send email that looks like it came from you, and whether files that should be private are sitting in the open. We never look behind a login, and the check is designed not to change anything on your site. A good grade means fewer known problems in what we checked. It does not mean your site is secure.
Most break-ins start with someone reading what a site gives away for free. This check does that first look and tells you what it found.
We check your certificate, the encryption versions your site accepts, the security settings it sends to browsers, how its cookies are protected, whether visitors get sent to the secure version, a short list of files that should never be public, and the DNS records that stop others sending email in your name. A ransomware readiness review starts with the same basics.
The free check sends about fifteen requests. Most are ordinary page and DNS lookups. Some ask for files that should never be public, like backup and configuration files. Some use old encryption versions that no browser would use. It never tries a password, never submits a form and never looks behind a login. It is designed not to change anything on your site.
If you prove you own the site, you can run a closer check that contacts your site more actively: admin paths, HTTP methods, forms, ports and software versions. It sends read-only requests: GET, plus one OPTIONS and one TRACE to see which methods the site accepts, and plain connections to common ports. It sends at most 200 requests in under two minutes. The job runs the free check again first, with a three-minute limit overall. It is designed not to change anything: no request bodies, no PUT or DELETE, and links or forms that look like actions are skipped.
It is built not to. The free check sends about fifteen requests, including ones for files that should not be public (such as backup and configuration files) and test connections using old encryption versions that no browser would make. The deeper checks send at most four requests a second and 200 in total, within two minutes; that job also runs the free check again, with a three-minute limit overall. They are designed not to change anything: no request bodies, no PUT or DELETE, and links or forms that look like actions are skipped.
The free check covers your certificate and encryption, browser security headers, cookie settings, the redirect to https, a short list of files that should not be public, security.txt, and the DNS and email records (SPF, DMARC, MTA-STS, CAA and DNSSEC). Anything we could not check is listed separately and never counted as a pass.
Because the deeper check contacts your site more actively, and nobody should be able to point it at someone else's. You prove control by adding a DNS record, a small file or a meta tag, use a work email at that domain, and confirm that you own the domain or are allowed to test it.
Your results appear on this page and you can print them or save them as a PDF. For the deeper check, if email delivery is enabled, the PDF report is sent only to the work email you gave at the verified domain.
No. It is a free outside check for known, common problems. A penetration test is a scoped, authorized engagement where people try to get in. If you need one, we can talk you through what it involves.
To stop abuse, each scan is recorded in an audit log with the time, your connection's address and the domain scanned, and the page uses Cloudflare Turnstile (challenges.cloudflare.com) as a bot check. Results are kept for about fifteen minutes and then deleted. When you verify a site for the deeper check, the audit log keeps a keyed hash of your email address, not the address itself; only if email delivery is enabled is the address held in memory, for up to 24 hours, to send the report. Like every page on intelamation.com, this page also loads the site's analytics and cookie scripts (ia-tracker, the Pulse beacon, the cookie banner and the chat widget). If you fill in the “talk to us” form, we receive what you type plus the domain, grade and counts, never the details of what we found.
In a 45-minute call we will walk through your results, tell you which fixes are quick, and which ones need a closer look.
