Find the open doors
before attackers do.
Two passive scans built for small business. Check your front door free, or walk your whole perimeter.
Security CheckYour front door
Is your website secure?
An A–F grade for your website, email and DNS in 60 seconds. Unlock every fix for $7.
Free grade · $7 full report
No account · No subscription · What it checks
Knock KnockYour whole perimeter
See what an attacker sees about your business.
One scan maps every exposed door and window — domains, email, DNS, hosting, subdomains and WordPress — and tells you what to lock first.
$20 introductory · one-time
You confirm ownership on the next step · What it maps
Passive and read-only. Public information only. Scan only domains you own.
What we check
Start at the door. Then walk the perimeter.
The same things automated attack tools look for first — checked from the outside, the way they see you.
Security CheckYour front door
Free grade · $7 full report
Email spoofing
Can criminals send email that looks like it's from you?
SPF · DKIM · DMARCSecurity headers
The protections that stop common browser attacks.
HSTS · CSPExposed files
Leaked config or source files anyone could grab.
/.env · /.gitTLS certificate
Is your padlock actually valid and current?
Certificate expiryDNS & takeover risk
Misconfigurations attackers exploit.
CNAME takeoverOutdated software
Old website software with known weaknesses.
CMS versions
Knock KnockYour whole perimeter
$20 introductory · one-time
Everything in the front-door check
Email, headers, TLS and DNS — included.
Exposed subdomains
The forgotten test sites and old portals still answering.
~1,000-name sweepHosting & infrastructure
Where you run, who runs it, and what's showing.
Hosts · providersWordPress risk
Plugins and versions with known, public exploits.
NVD CVEsLook-alike domains
Names close enough to yours to fool a customer.
Domains to watchWhat to lock first
Every finding ranked, each with a plain-English fix.
How it works
Three steps. Nothing to install.
Enter your domain
Both scans are passive and read-only — only what anyone on the internet can already see. We never touch the inside of your systems.
See what's exposed
Your free grade comes back in seconds. Knock Knock maps your full footprint in a few minutes.
Lock it down
Every issue in plain English with the exact fix, ranked by urgency. Fix it yourself or forward it to your web person.
Sample · Security Check report
This is what $7 gets you.
Every issue ranked by urgency, in plain English, with the exact fix — do it yourself or forward it to whoever runs your website.
- Ranked from Critical to Low
- The exact fix for every issue — copy-paste records and settings
- Download it — keep it, print it, forward it
Pricing
Pay once. No subscription.
Security Check · Free grade
$0
no account · no card needed
- A–F grade and a score out of 100
- Issue count by severity
- Which areas have problems
Security Check · Full report
$7
one time · no subscription
- Everything in the free grade
- Every issue in plain English
- The exact fix for each one, ranked
- Downloadable report + private link
Knock Knock · Perimeter scan
$20
introductory · one time · no subscription
- Everything in the full report
- Subdomains, hosting and infrastructure
- WordPress plugin and version risk
- Look-alike domains to watch
- Ranked: what to lock first
Security Check: you're only offered the $7 report if we actually find something to fix. Secure checkout by Stripe · Sales final; failed or incomplete reports fixed or refunded.
New: use it inside Claude. Add the Small Business Security Check connector and ask Claude to scan your site, explain every issue and walk you through the fix — $7 per scan or $20 per Knock Knock footprint, buy as many as you need. Set it up →
Why trust it
Safe, private, and honest
Passive & read-only
We only look at what any visitor can already see. We never log in, never attack, and never touch your systems.
Private by default
Your report lives at its own unguessable link — only people you share it with can see it. Want it deleted? Email us and we'll remove it.
Built by a professional penetration tester
The same first checks a pro runs on day one — automated, in plain English, and priced so there's no reason to keep guessing.
Only scan a domain you own or are authorized to check. Assessment based on publicly observable data — not a guarantee.
FAQ
Common questions
Is this legal / safe to run on my site?
Yes. The check is passive and read-only — it only looks at information your website already shows the public. Only scan a domain you own or are authorized to check.
Do I need to install anything?
No. Enter your domain, get your grade. That's it.
What's the $7 for?
The full report: every issue we found, explained in plain English, with the exact steps to fix it. One-time — no subscription.
Will this make me bulletproof?
No honest tool would promise that. It's a fast, real first look at the things attackers check first — and a clear list of what to fix.
Why would anyone target a business my size?
Automated tools don't pick targets by size — they scan huge numbers of websites and flag whatever is easy. A small business with a spoofable email domain or an outdated plugin looks the same to them as anyone else.
What if you don't find anything?
You get your grade free and you won't be offered the report — there's nothing to buy. Re-check any time as your site changes.
Can I give the report to my web person?
Yes. Every item stands on its own with the exact fix, so you can forward the whole report or just one issue to whoever runs your website, email, or domain.
What's the difference between the free check and Knock Knock?
The free check grades your front door: your website, email and DNS. Knock Knock walks your whole perimeter: subdomains, hosting, WordPress risk and look-alike domains, ranked by what to lock first. Both are passive and read-only.
Can I get a refund?
Because the report is delivered instantly, sales are final — but if a report fails to generate or is incomplete, email us and we'll fix it or refund it.