Skip to content
Check a domain

Website security check · from $8

Website security check, in plain English.

Type your address. See what your website shows the internet and what to fix first. Nothing to install, read-only from start to finish.

Quick Scan

Areas checked
11
In good shape
2
Fixes in minutes
4 of 6
  1. Medium

    Keep the login cookie on HTTPS

    F2 · Confirmed · Minutes

    Evidence

    Observed
    Set-Cookie: PHPSESSID=…; path=/
    Expected
    Set-Cookie: PHPSESSID=…; path=/; Secure; HttpOnly; SameSite=Lax

    Fix

    1. Add the Secure and HttpOnly flags (and SameSite=Lax) to session cookies.
    2. In PHP: session.cookie_secure = 1 and session.cookie_httponly = 1.
  2. Low

    Add a DMARC record for your domain

    F3 · Confirmed · Minutes

    Evidence

    Observed
    _dmarc.example.com TXT (no record)
    Expected
    _dmarc.example.com TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

    Fix

    1. Publish a _dmarc TXT record.
    2. Start with v=DMARC1; p=none; rua=mailto:dmarc@your-domain to monitor, then move to p=quarantine.
  3. Medium

    Update an outdated component

    F1 · Likely · Hours

+ 5 more findings in the full report Open the sample report

What you get

A report you can act on.In plain English, with evidence.

A check reads the signals any browser can already see: headers, HTTPS, cookie flags, email-spoofing protection, outdated software and DNS records. The report is written for the owner, with evidence a developer can verify.

  • A preview before any account
  • Each finding: what it means, the fix, how long it takes
  • Light, read-only checks from a scanner that names itself
  • $8 for 1 check, $18 for 5, $59 for 20 (+ applicable tax); no subscription

Real format

Two findings.Exactly as a report shows them.

Open the full sample report

F2 · cookie-flags

Keep the login cookie on HTTPS

Medium Confirmed Minutes

What it means
The session cookie is set without the Secure flag. Adding it keeps the cookie on encrypted connections, so signed-in sessions stay private, even on public Wi-Fi.
Evidence
Set-Cookie: PHPSESSID=…; path=/
              ↑ no Secure, no HttpOnly
Expected
Set-Cookie: PHPSESSID=…; path=/; Secure; HttpOnly; SameSite=Lax
Fix
Add the Secure and HttpOnly flags (and SameSite=Lax) to session cookies. In PHP: session.cookie_secure = 1 and session.cookie_httponly = 1.

F1 · technology-fingerprint

Update an outdated component

Medium Likely Hours

What it means
Your homepage announces PHP 7.4. Moving to a supported version brings back regular security updates and closes the issues public vulnerability data lists for 7.4.
Evidence
X-Powered-By: PHP/7.4.3
PHP 7.4 — end of life 2022-11-28
Expected
A supported PHP 8 release (8.3 or later), version not announced (expose_php = Off)
Fix
Ask your host to move the site to a supported PHP version (8.x). Then stop advertising the version at all: set expose_php = Off.

Pricing

From $8 a check.Buy more, pay less per check.

Plus applicable tax, shown before you pay. No subscription.

See pricing and the calculator

Quick Scan

Available

5 checks cover a month of weekly checks for $18. No subscription.

  • One credit checks one website
  • Credits last 12 months
  • No subscription, no auto-renewal
  • Credit back automatically if your scan can't run or half or fewer of its checks run. If your website blocks us but most checks ran, the website checks re-run free, once, within 30 days. How credits work

Your first check is free — on a website you've verified you own.

Scan your domain

Checkout by Stripe. We never see your card.

Prices before tax. Final total shown before you pay.

Powered by Stripe

Apple Pay Google Pay · Link · Visa · Mastercard · American Express

Where available for your device and country.

Questions

Short answers.

Something else? support@scandefend.com

Is this a website security scan or a full audit?

A scan of what your site shows the public: ScanDefend reads your public homepage and the files it links to, a few standard public files like robots.txt and security.txt, and your public DNS records, read-only, and the report states exactly what was in scope. The formal statement of scope is in the Terms.

Is it gentle on my website?

Yes. It's built to stay light: a small number of polite, read-only requests, the same kind a browser makes.

Do I need technical knowledge to use the report?

Plain English throughout. Each finding has a "what it means" line and a "how to fix it" line you can forward to whoever looks after your site.

Keep exploring

Also useful: Small business scanner Sample report Pricing

See what your website shows.Know what to fix first.

See pricing