Skip to content
Check a domain

For small businesses · from $8

A website security scanner for small businesses, written in plain English.

Someone else built your website. Find out what it tells the world, including whether others can send email as you, in words you can forward.

Quick Scan

Areas checked
11
In good shape
2
Fixes in minutes
4 of 6
  1. Medium

    Keep the login cookie on HTTPS

    F2 · Confirmed · Minutes

    Evidence

    Observed
    Set-Cookie: PHPSESSID=…; path=/
    Expected
    Set-Cookie: PHPSESSID=…; path=/; Secure; HttpOnly; SameSite=Lax

    Fix

    1. Add the Secure and HttpOnly flags (and SameSite=Lax) to session cookies.
    2. In PHP: session.cookie_secure = 1 and session.cookie_httponly = 1.
  2. Low

    Add a DMARC record for your domain

    F3 · Confirmed · Minutes

    Evidence

    Observed
    _dmarc.example.com TXT (no record)
    Expected
    _dmarc.example.com TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

    Fix

    1. Publish a _dmarc TXT record.
    2. Start with v=DMARC1; p=none; rua=mailto:dmarc@your-domain to monitor, then move to p=quarantine.
  3. Medium

    Update an outdated component

    F1 · Likely · Hours

+ 5 more findings in the full report Open the sample report

What you get

A report you can act on.In plain English, with evidence.

ScanDefend checks the public side of your website and your domain's email setup, then explains each finding with a first step. Nothing to install, no passwords to hand over.

  • Email spoofing (SPF and DMARC): can others send email as you?
  • Outdated software your homepage announces
  • A report you can paste into an email to your web designer
  • $18 for 5 checks (+ applicable tax): one now, the rest for after the fixes

Real format

Two findings.Exactly as a report shows them.

Open the full sample report

F3 · dns-email-auth

Add a DMARC record for your domain

Low Confirmed Minutes

What it means
A DMARC record tells receiving mail servers what to do with email that claims to come from your domain, so they can turn away mail that only pretends to be you.
Evidence
_dmarc.example.com  TXT  (no record)
Expected
_dmarc.example.com TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com"
Fix
Publish a _dmarc TXT record. Start with v=DMARC1; p=none; rua=mailto:dmarc@your-domain to monitor, then move to p=quarantine.

F1 · technology-fingerprint

Update an outdated component

Medium Likely Hours

What it means
Your homepage announces PHP 7.4. Moving to a supported version brings back regular security updates and closes the issues public vulnerability data lists for 7.4.
Evidence
X-Powered-By: PHP/7.4.3
PHP 7.4 — end of life 2022-11-28
Expected
A supported PHP 8 release (8.3 or later), version not announced (expose_php = Off)
Fix
Ask your host to move the site to a supported PHP version (8.x). Then stop advertising the version at all: set expose_php = Off.

Pricing

From $8 a check.Buy more, pay less per check.

Plus applicable tax, shown before you pay. No subscription.

See pricing and the calculator

Quick Scan

Available

5 checks cover a month of weekly checks for $18. No subscription.

  • One credit checks one website
  • Credits last 12 months
  • No subscription, no auto-renewal
  • Credit back automatically if your scan can't run or half or fewer of its checks run. If your website blocks us but most checks ran, the website checks re-run free, once, within 30 days. How credits work

Your first check is free — on a website you've verified you own.

Scan your domain

Checkout by Stripe. We never see your card.

Prices before tax. Final total shown before you pay.

Powered by Stripe

Apple Pay Google Pay · Link · Visa · Mastercard · American Express

Where available for your device and country.

Questions

Short answers.

Something else? support@scandefend.com

What will the report actually tell me?

What we found, how much each thing matters and how to fix it, with a clear statement of what was in scope. Every finding comes with the evidence behind it.

New to DMARC or HSTS? Is this still for me?

Yes. Every finding has a plain "what it means" line written for the business owner and a "how to fix it" line written for the person who looks after the site.

Short on time?

The report orders findings by what matters most and says roughly how long each fix takes. Forward it and keep a spare credit to re-check afterwards.

Keep exploring

Also useful: Website security check Sample report Pricing

See what your website shows.Know what to fix first.

See pricing