Is the connection safe?
Your security certificate and when it expires, whether visitors are moved to the secure https version, and the four browser security settings that block common attacks.
Home / Free checkup
Free checkup · instant results
Is your website and email locked down? Find out in seconds.
Enter your website and your email. In about 10 seconds you get a report card on your site's security, your email protection and whether AI assistants can read your business details, with plain-English steps to fix anything that needs it.
Read-only, like one normal visit to your site plus a look at your public DNS. Nothing on your site is changed or attacked. Your results and email come to me, Sam, so I can follow up if you want help. Never sold, never added to a newsletter. Good to know: this is a quick health check of the basics, not a security audit. What that means.
What the checkup looks at
Three areas, nine checks
The same checks I run before any site I build goes live.
Can someone pretend to be you?
SPF, DKIM and DMARC: the three records that decide whether your real email reaches inboxes and whether fake email sent in your name gets stopped.
Can AI assistants read your details?
A clear page title and description, business details in a format machines understand, and whether your site blocks AI assistants from reading it.
Good to know
A health check, not a security audit
This free checkup looks at the basics anyone can see from the outside: your public DNS records, your security certificate, and the settings your website shares with every visitor. Think of it like checking that the doors are locked and the porch light works. It is a great first look, and it catches the most common gaps.
A true security audit goes much further: inside your systems, your accounts and how your team works. That kind of work is done as a paid engagement, with a non-disclosure agreement and signed agreements that set expectations and protect both of us. It is the right way to handle something that sensitive.
So please read your results as helpful pointers, not a clean bill of health or a guarantee. If you would like a full audit, ask a tech question and we can talk about what it would cover.
Straight talk
Think of it as tech support, not a sales pitch.
Every result comes with the steps to fix it yourself, for free. If you would rather hand it off, one click sends the findings to me and I will tell you what it takes. Either way, you are not signing up for anything.
Honest noteThe AI-ready section checks the signals AI assistants rely on. Nobody can check or promise what ChatGPT, Gemini or any other assistant will actually say about your business.
- Read-only. One normal page visit and public DNS lookups. No scanning of ports, no logins, no attack tests.
- Your email stays with me. Your results and email come to me, Sam, so I can answer questions or follow up personally. They are never sold, shared or added to a newsletter, and one reply asking me to stop is all it takes.
- Shareable. Every report has its own link you can send to whoever manages your website or email.
Straight answers
Checkup questions
Is the checkup really free?
Yes. It runs automatically, and the fix-it steps are free too. I ask for your email so I can follow up personally if your results need attention. If you want help fixing something, that is your call.
Why do you need my email?
So the results reach a real person who can help. Your report comes to me, Sam, and I may send you a short note about anything important it found. No newsletter, no list, and just reply "stop" if you would rather not hear from me.
Can I check a site that is not mine?
The checkup only reads what any visitor and any email server can already see, so it is safe to run on a vendor's or competitor's site. It is most useful on your own.
Is this a security audit?
No. It is a quick health check of what is publicly visible, like DNS records, your certificate and your site's security settings. A full security audit is a paid engagement done under a non-disclosure agreement and signed agreements, because it looks inside your systems.
My grade is low. Is my site hacked?
Almost certainly not. A low grade usually means protective settings were never turned on. Most fixes take minutes, and the steps are right under each result.
Why did it not find my DKIM key?
DKIM keys live under names your email provider picks. The checkup looks in the common places for Microsoft 365, Google Workspace and others. If yours uses a custom name, check your email settings to confirm signing is on.
Does this check whether ChatGPT mentions my business?
No, and be wary of anyone who says they can promise that. The checkup looks at the things AI assistants rely on to describe you correctly, which you can control.
Prefer to talk to a person?
Ask a tech question. Get a straight answer.
If something in your report does not make sense, ask. I answer as quickly as possible, in the order questions come in.
Free fix-it guides live in the Help Center.