Free instant check of your site's TLS certificate, security headers, email spoofing protection and DNS. Get grades from A+ to F, see how each gap actually gets exploited — and plain-English fixes for everything we find.
One free scan, three jobs: a security headers checker, an SSL/TLS certificate test, and an email spoofing test (SPF, DMARC, DKIM). Every finding is explained the way an attacker sees it — and how to fix it.
The free scan reads your public configuration. The assessment goes hunting — and a consultant reviews every word before it reaches you.
| Free scan | Full Assessment — $99 | |
|---|---|---|
| Instant grades & findings (TLS, headers, email, DNS) | ✓ | ✓ |
| Attacker's view + plain-English fixes | ✓ | ✓ |
| Exposed-file probing (.env, .git, backups) | — | ✓ |
| Subdomain attack-surface map (from public cert records) | — | ✓ |
| Live-host analysis — test/dev, sign-in & remote-access hosts flagged | — | ✓ |
| Mail-server spam blocklist check (10+ lists) | — | ✓ |
| Mail-server encryption & certificate checks | — | ✓ |
| AI security surface — exposed AI apps, chat widgets, AI keys | — | ✓ |
| Dangling-DNS (subdomain takeover) check | — | ✓ |
| Priority fix plan — the order to tackle things | — | ✓ |
| Executive summary + consultant's note | — | ✓ |
| Personally reviewed, delivered by email | — | ✓ |
Run the instant check above. See your grades and the worst gaps in seconds.
$99 one-time. The deep scan runs automatically the moment payment clears.
A consultant reviews the findings personally, then the full report lands in your inbox — within one business day.
Headers and TLS are about 5% of a real assessment. I run full security reviews for small businesses — attack surface, auth, cloud config, and a fix-it plan your team can actually follow.
Closing the gaps — implementation, hardening, monitoring — is retainer work, scoped after the assessment.
Ask about retainersYes. It is read-only: it looks at your public certificate, response headers and DNS records — the same things any browser sees. No logins, no passwords, no attack payloads, nothing is changed or stored beyond the result you see.
Checks the free scan does not run: exposed sensitive files (.env, .git), your full subdomain attack surface from public certificate records with live-host analysis, mail-server spam blocklists, mail-server encryption and certificate checks, your AI security surface, and dangling DNS records an attacker could claim. You also get a priority fix plan and a report that is personally reviewed by a cybersecurity consultant before it is emailed to you.
The deep scan runs as soon as payment clears, and the reviewed report is delivered by email within one business day.
The report gives you (or your IT person) a plain-English fix for every finding, in priority order. Hands-on remediation — implementation, hardening and monitoring — is available as consulting retainer work.
A Canadian cybersecurity engineer who assesses business systems for a living. Every $99 report is reviewed by him personally before delivery.
Security headers tell browsers how to protect your visitors. Without a Content-Security-Policy and clickjacking protection, your site can be used to attack the customers who trust it — and most small-business sites are missing at least one.
If your SPF, DMARC and DKIM records are weak, anyone can send email that looks exactly like it came from you — a fake invoice with "new bank details" is the classic. One DMARC record at full enforcement stops it cold.
Gmail and Outlook trust domains with proper email authentication. Fixing these records means your real quotes, invoices and password resets are less likely to land in your customers' spam folders.