Free website security check
Check the public surface of your web app, free
Good news first: checking your website's security does not need to be confusing, technical, or expensive. Our free web application security scanner looks at your site from the public side, the same way a visitor or a search engine sees it, and gives you a clear A to E grade in about 10 seconds.
You do not need an account to see your grade, and there is nothing to install. Pop in your web address, and we will run around 35 to 40 checks across roughly a dozen security areas, then explain every finding in plain English so you actually know what it means and what to do next.
It is free, non-intrusive, and there is no obligation. The only paid path is optional: if you would like a hand fixing anything, the Expect Best team can do that for you. Otherwise the scan, and the plain-English explanations, are yours to keep.
What the free scan checks
Our scanner reads the signals your website already shows the outside world and checks them against current good practice. It is a thorough external health check, not a guess. Here is the kind of thing it looks at:
- Secure connection: whether you use HTTPS, and whether your SSL certificate is valid, trusted, and not close to expiring.
- Security headers: HSTS, Content-Security-Policy, X-Frame-Options (which helps stop clickjacking), X-Content-Type-Options, Referrer-Policy and Permissions-Policy.
- Cookie safety: whether your cookies use the Secure, HttpOnly and SameSite flags.
- Information leaks: server version banners and other details that quietly help attackers.
- WordPress basics: whether the core version is current and whether admin usernames are exposed.
- Email spoofing protection: SPF, DMARC, DKIM, BIMI and MTA-STS, so scammers find it harder to impersonate you.
- Exposed files and folders: config files, .env, .git or backups that should not be reachable in public.
- Directory listing: open folders that show their full file list to anyone.
- Domain protection: DNSSEC and CAA records.
- Reputation and blocklists: whether your site is flagged as malicious by Google Safe Browsing or common malware and spam blocklists.
- Outdated software: old jQuery, PHP or components with known issues.
- Good housekeeping: a security.txt file and Subresource Integrity on third-party scripts.
What the scan does not do (and why that is fine)
We would rather be straight with you than over-promise. The free scan is an external, non-intrusive check, so there are some things it deliberately does not do.
It does not try to break into your site. There is no penetration testing, no SQL injection or cross-site scripting attempts, no brute-forcing passwords and nothing that could disrupt your site for real visitors.
It does not scan the files on your server for malware, and it cannot remove malware. For malware it checks your reputation only: whether your site has been flagged by Safe Browsing or blocklists, and whether any risky files are exposed in public.
If you need something deeper, such as a full penetration test or cleaning up a site that has been infected, the Expect Best team can help. We will never pretend the free scan has done that for you.
- No active exploitation: no SQL injection, cross-site scripting, brute force or DDoS attempts.
- No server-side malware scanning or removal: reputation and exposed-file checks only.
- No logged-in scans: it does not sign in to test the area behind your login.
- No plugin-by-plugin CVE check: for WordPress it looks at the core version and exposed admin usernames.
Free monthly monitoring, if you want it
Security is not a one-off. New issues can appear as software ages or settings drift, so you can opt in to free monthly monitoring.
We re-check your site each month and email you only if your grade changes, so you are not buried in alerts. There is no account to manage, no cost, and you can cancel any time.
It is a calm, hands-off way to keep an eye on things between bigger reviews, and it keeps working quietly in the background so you do not have to remember to come back.
- Re-checked automatically every month from the public side.
- An email only when your grade changes, not constant noise.
- No account, no cost, and you can cancel any time.
Free, instant, no account
See your site's security grade in seconds.
Free, instant, and no account needed to see your grade.
Plain-English A to E grade in about 10 seconds. No account needed to see it.
Who it is for
This tool is built for ordinary business owners, not security specialists. If you run a small shop, a service business or a charity and you just want to know whether your website is in good shape, you are exactly who we made it for.
You can check a single site or, with monitoring, keep an eye on up to 100 sites. Everything is explained in plain English, with no jargon and no pressure, so you can decide what matters to you and act in your own time.
- Small businesses, service firms and charities who want a clear answer.
- Anyone managing one site, or up to 100 sites with monitoring.
- People who want plain English, not jargon or scare tactics.
Common questions
Is the web application security scanner really free?
Do I need an account or to install anything?
Will the scan harm or slow down my website?
Does it check my site for malware?
Is this a full penetration test?
What does the A to E grade mean?
Related guides
Keep exploring
Free, instant, no account
Check your website now, free.
A plain-English A to E grade in about 10 seconds, plus free monthly monitoring.
Plain-English A to E grade in about 10 seconds. No account needed to see it.