Is the lock on the door real?
Certificate validity and expiry, old TLS versions, and HTTPS redirects.
How this check worksFree website security check · no signup
See your website the way an attacker does.
In about a minute you get a letter grade, every problem explained in plain English, and the exact fix for your hosting. Then PerimeterX keeps watch, so it stays fixed.
- 34 checks in about 60 seconds
- Passive: never attacks or slows your site
- No card, no signup
Passive and legalWe only read what any visitor’s browser can already see.
Owner-verified deep checksExact weak spots are shown only to the verified owner.
Graded by real risk34 checks, weighted by how easily each could be used.
No-risk paid plans14-day free trial, cancel any time, payments by Paddle.
Start free. Pay only when you want us watching.
Here is exactly what you get at each step, so there are no surprises.
$0 · no signup
Free check
For any website, yours or anyone’s.
- Letter grade and a grade for each area
- Every problem we found, in plain English
- How urgent each one is
- Exact locations and copy-paste fixes
- Automatic re-checks and alerts
$0 · free account
Your own site, fixed
Prove you own your website to unlock everything about it.
- Full report with exact locations
- Copy-paste fixes for Nginx, Apache, Cloudflare or any host
- Exposed-file checks (.git, .env, backups)
- Public grade badge for your site
- Full report once a month only
From $9/month · 14-day free trial
We keep watch
For businesses that can’t afford to find out last.
- Automatic weekly or daily re-checks
- Email alert the moment your grade drops
- Unlimited full reports and fixes
- Up to 40 sites, full PDF reports and active testing on higher plans
Find it. Fix it. Keep it fixed.
PerimeterX does the security work small teams never get to, and tells you only what you need to act on.
Free
Find what’s exposed, before anyone else does
We look at your site from the public internet the way an attacker would: encryption, browser protections, email spoofing, outdated software and leaked files. Then we grade it, A to F.
Run the free checkFree account
Fix it with copy-paste steps for your hosting
No security jargon. Every problem says what it is, why it matters, how long it takes, and the exact change for Nginx, Apache, Cloudflare or any host. Re-check in one click to confirm it’s fixed.
Create a free accountPaid plans
Keep it fixed while you get on with your work
Websites change: a plugin update, a new developer, an expiring certificate. PerimeterX re-checks on a schedule and emails you the moment your grade drops, with the fix.
Free account
Show customers you take security seriously
Publish a live grade badge on your site and a public grade page you can share in proposals and security questionnaires.
A grade you can trust, because you can see how it’s made
Every check is weighted by how easily an attacker could use the problem, then rolled up into a grade for each area and one grade for the site.
- The same checks, run the same way, every time
- Each finding says what it is, why it matters and how long it takes to fix
- Re-check after a fix to see your grade move
ANothing important is exposed.
BSmall improvements to make.
CWorth fixing this month.
DReal weaknesses to fix soon.
FSomething serious is open now.
Five areas, graded separately
- Encryption certificate, TLS versions, HTTPS
- Browser protections security headers, cookies
- Exposed files .git, .env, backups (owners only)
- Software outdated libraries, version leaks
- Email spoofing SPF, DMARC, MTA-STS
The first five minutes of an attack, run for you
Attackers start by looking at your site from the public internet. We run the same look, grade it, and stop there.
Does your site tell browsers to protect visitors?
HSTS, Content-Security-Policy, framing protection and cookie flags.
How this check worksCan someone send email as you?
SPF and DMARC records: the main defence against fake-invoice scams.
How this check worksAre you running something with known holes?
Outdated JavaScript libraries and software versions your site gives away.
How this check worksLeft anything lying around?
Exposed code history and settings files. Checked only for verified owners.
How this check worksCan people report problems to you?
A security.txt file so researchers can reach you before attackers do.
How this check worksOur commitments
Security tools should be safe to point at any website. These rules are built into how PerimeterX works.
We never attack your site
No logins, no password guessing, no attack code. The free check reads only public information.
We never slow it down
A check makes a small number of spaced-out requests, about as many as one person browsing a few pages.
Weak spots stay private
Exact locations and versions are shown only to the verified owner, so a report can’t be used against anyone.
We respect “no”
Our scanner identifies itself, follows robots.txt and honours every opt-out request.
Deeper tests only with permission
Active testing runs only on sites you’ve verified and explicitly authorised, and every test is logged.
Your card never touches us
Payments, tax and invoices are handled by Paddle, our merchant of record. Cancel any time.
For agencies and freelancers
Build websites for clients? Grade every one of them.
Watch your whole portfolio from one dashboard, know before your clients do, and turn a free grade into a paid maintenance contract.
- client-dental.comA
- client-lawfirm.comC
- prospect-hotel.comD
Common questions
Can’t find what you need? Read how we scan or browse the security guides.
What’s free and what do I pay for?
The check is free for any website, with no signup. A free account adds the full report and exact fixes for your own site once a month. Paid plans, from $9 a month with a 14-day free trial, add automatic re-checks, alerts when your grade drops, unlimited full reports, more sites and PDF reports.
Is it legal to check a website I don’t own?
The free check only reads what any visitor’s browser can already see: the certificate, the headers the site sends, and public DNS records. It never logs in, guesses passwords or sends attack code. Deeper checks run only after you prove you own the site.
Will the check slow my site down?
No. A basic check makes a small number of spaced-out requests, about as many as one person browsing a couple of pages.
What does the letter grade mean?
Every check is weighted by how easily an attacker could use the problem. A means nothing important is exposed. F means something serious is open right now.
Why are some details hidden?
Exact file locations and software versions are only shown to the verified owner, so a report can never be used as a map against someone else’s site.
How do I stop PerimeterX from checking my site?
Add a robots.txt rule for PerimeterScanner, or use the opt-out form on our How we scan page. We refuse all future checks of that domain.
Find out what an attacker sees. It takes a minute.
Free, no signup. Passive checks only.