NullSquareAlpha

Free · No password

Free website security check

Enter your domain. In under a minute, our agent checks what anyone can see of your website from the internet, and shows you what to look at first.

Public information only. The check sends a small number of normal web requests, as one visitor does.

What the check looks at

HTTPS and certificate
If the site sends visitors to HTTPS, which TLS version it uses, and when its certificate expires.
Security headers
Six headers that tell a browser to block common attacks: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy.
Cookies
Cookies that the site sets without the Secure and HttpOnly flags.
Email and DNS
SPF and DMARC records, which stop other people sending email as your domain. CAA records, which control who can issue certificates for it.
Subdomains
Hostnames in public certificate logs, test and staging sites left online, and DNS records that point to services you no longer use.
Known vulnerabilities
Software versions that your server shows, compared with the public vulnerability database (NVD).
WordPress
Plugins and themes that your page source shows, with their versions.
Domain and contact
How long ago the domain was registered, and if you publish a security.txt contact for researchers.

What you get

  • A list of results, with the most important first.
  • A short explanation of why each result matters.
  • The source of each result, so you can check it yourself.
  • A free account with Google, GitHub or your email, and no password. The results show on screen in under a minute.

What the check does not do

  • It does not log in and it does not try attacks. Your agent works on the site only after you prove that you own it.
  • It does not remove malware or clean a hacked site.
  • It does not give a compliance certificate.
  • A version match is a lead, not proof that the site can be attacked.

After the check

Verify that you own the site with one DNS record. Where your DNS provider offers it, such as Cloudflare, it adds the record for you in one click. Then your agent starts working on it: it watches the site every day, reviews your code and answers your customers' security questions.

Verifying the site gives your agent $5 of free use to start watching it. Pro adds $50 of use each month. See the plans

Questions

Is the website security check really free?
Yes. The check is free, with a free account and no password. When you verify the site, your agent gets $5 of free use. You pay only if you choose Pro.
Is it safe to run on my live website?
Yes. The check reads public records and sends a small number of normal web requests, as one visitor does. It does not try to break in.
Can it tell me if my website is hacked?
Not fully. It shows what anyone can see from outside. It does not scan your files for malware. If you think that your site is hacked, speak to your host first.
Does it work for Shopify, Wix and Squarespace sites?
Yes. It checks any public website. On a hosted platform, the platform controls some settings, such as security headers, so you cannot change every result yourself.
How often should I check my website?
After each large change, and at least once a month. Once you verify the site, your security agent checks it for you on a schedule.
How is this different from a penetration test?
The check reads public information. A penetration test tries real attacks, with your permission, to prove what an attacker can do. The free check is where NullSquare starts. Authorized tests of a site you have verified come next.

Check your website now