Is the lock on the door real?
Certificate validity and expiry, old TLS versions, and HTTPS redirects.
How this check worksSee your website the way an attacker does.
Type your website address. In about a minute you get a letter grade, a list of what’s exposed in plain English, and the exact fix for each problem on your hosting.
Free, no signup. Passive checks only: we never attack or overload your site.
The first five minutes of an attack, run for you
Attackers start by looking at your site from the public internet. We run the same look, grade it, and stop there.
Does your site tell browsers to protect visitors?
HSTS, Content-Security-Policy, framing protection and cookie flags.
How this check worksCan someone send email as you?
SPF and DMARC records: the main defence against fake-invoice scams.
How this check worksAre you running something with known holes?
Outdated JavaScript libraries and software versions your site gives away.
How this check worksLeft anything lying around?
Exposed code history and settings files. Checked only for verified owners.
How this check worksCan people report problems to you?
A security.txt file so researchers can reach you before attackers do.
How this check worksHow it works
Enter your address
We read only what any visitor’s browser can already see: your certificate, headers and public DNS records.
Get your grade
Every problem comes with what it is, why it matters and how urgent it is for a business like yours.
Fix it and prove it
Verify you own the site for copy-paste fixes, weekly monitoring and a grade badge you can show customers.
Build websites for clients? Grade every one of them.
Monitor your whole portfolio, send white-label reports under your own brand, and turn a free grade into a paid maintenance contract.
See the Agency plan- client-dental.comA
- client-lawfirm.comC
- prospect-hotel.comD
Common questions
Is it legal to check a website I don’t own?
The free check only reads what any visitor’s browser can already see: the certificate, the headers the site sends, and public DNS records. It never logs in, guesses passwords or sends attack code. Deeper checks run only after you prove you own the site.
Will the check slow my site down?
No. A basic check makes a small number of spaced-out requests, about as many as one person browsing a couple of pages.
What does the letter grade mean?
Every check is weighted by how easily an attacker could use the problem. A means nothing important is exposed. F means something serious is open right now.
Why are some details hidden?
Exact file locations and software versions are only shown to the verified owner, so a report can never be used as a map against someone else’s site.
How do I stop Perimeter from checking my site?
Add a robots.txt rule for PerimeterScanner, or use the opt-out form on our How we scan page. We refuse all future checks of that domain.