Most website owners find out about a security problem when a customer complains, an SSL certificate expires or Google drops their rankings. A few quick checks now can catch each of those early, and every check below is free and works on any website.
You do not need to install anything or know how to code. Type in your address, read the result and fix what it flags. The checks work the same on WordPress, Shopify, Wix, Joomla, Magento and custom-built sites, because they look at your site from the outside, the way a visitor or a search engine does.
1. Malware and hack check
Start here. The website malware scanner looks at your public pages for signs of a hack: hidden spam links, suspicious scripts, cloaking and exposed files. Hacked sites often look normal to their owners, so a page that seems fine is not proof that it is.
2. SSL certificate and expiry
An expired certificate shows visitors a full-page browser warning and sends most of them away. The SSL certificate checker shows who issued your certificate, whether it is valid and how many days are left, so you can renew before it lapses. Add a reminder for two weeks before the expiry date.
3. Security headers
Security headers are short instructions your server sends to browsers, such as "never load this page inside another site". Missing headers make common attacks easier. The security headers checker grades your site from A to F and lists what to add. If you want to go further, the Content-Security-Policy generator builds a policy for you to test before you enforce it.
4. Email authentication: SPF, DKIM and DMARC
If criminals can send email that appears to come from your domain, your customers are the ones at risk, and your real emails may land in spam. The SPF, DKIM and DMARC checker shows whether your domain is protected against spoofing and what to fix.
5. DNS and domain expiry
Your domain name is the one asset everything else depends on. Use the DNS lookup to confirm that your records point where you expect, and the domain expiry checker to see when your registration ends. A lapsed domain can be snapped up by someone else within days.
6. What a crawler really receives
The HTTP status and header viewer can fetch a page as a desktop browser, a mobile browser or Googlebot. If the response for Googlebot differs from what you see, that is a classic sign of cloaking. You can read more in our guide on what cloaking is.
7. Quality checks that protect your rankings
A secure site that nobody can find is not much use. These free tools help keep your visibility healthy:
- Broken link checker to find dead links and images.
- Page speed checker to spot slow pages.
- Website technology checker to see the CMS, server and CDN behind a site.
- Cookie and privacy checker to review cookies and consent.
- Accessibility checker to find common barriers for visitors.
How often should you check?
Run the malware, SSL and headers checks after every major change, such as a new plugin, theme, extension or developer handover. Beyond that, a monthly routine is a sensible minimum. If you manage many sites, or simply do not want to remember, continuous monitoring runs these checks for you and alerts you when something changes.
The full list lives on our free tools page.