Simulated results only
Preview sample categories for HTTP security headers, TLS and CAA, SPF, and DMARC. No requests are sent to the entered domain, and no DNS records are queried.
Simulated results only
This preview returns sample values only. No requests or DNS queries are sent to the entered domain.
Security configuration guide
Use HSTS to enforce HTTPS, a restrictive Content Security Policy to reduce script injection risk, `X-Content-Type-Options: nosniff`, and a frame policy. Add a Referrer Policy and a Permissions Policy that match your application. This page does not inspect headers on the entered domain.
Keep certificates valid, support TLS 1.2 or newer, and use CAA records to limit which certificate authorities can issue certificates. Use the TLS Chain Debugger to inspect a domain when you need a real certificate check.
Authorize legitimate senders with SPF, review DMARC reports before moving to a stricter policy, and publish an MTA-STS policy over HTTPS. This preview does not query or validate DNS records.
This public preview returns simulated results only. Authenticated security scans remain limited to verified agency websites.
No. It returns clearly marked sample results and sends no HTTP requests or DNS queries to the entered domain.
The preview shows simulated HTTP security header, TLS and CAA, and email anti-spoofing categories. It does not evaluate your actual settings.
No. The preview does not save results. The badge reads only the most recent cached scan; a badge request never starts a scan.
No. The preview is public and requires neither registration nor CAPTCHA. Requests are rate-limited per IP.
