TOOLBOX · WEBSITE SECURITY CHECK
Your Website. One Grade.
Seven checks in one run: headers, encryption, email, DNS, cookies, embedded content and security.txt. Enter a domain, get an overall grade, view the details.
SEVEN AREAS
What Goes Into
the Grade.
Each area is also a tool of its own. In the report, every line leads directly to the details for your domain.
- 01Weight 25
Security Headers
Checks HTTPS, HSTS, Content-Security-Policy, clickjacking protection and other headers of your website. With a grade from A+ to F and ready-made configuration.
Check Separately - 02Weight 20
SSL/TLS
Checks the certificate, chain and remaining validity, which TLS versions your server accepts and whether the encryption offers forward secrecy. With a grade and configuration.
Check Separately - 03Weight 20
Email Security
Can someone forge emails in your name? Checks SPF, DKIM, DMARC, MTA-STS and TLS-RPT of your domain. With a grade from A+ to F and ready-made DNS records.
Check Separately - 04Weight 10
DNS Security
Is your domain protected against forged DNS answers and wrongly issued certificates? Checks DNSSEC, CAA, name servers and dangling records. With a grade from A+ to F.
Check Separately - 05Weight 10
Cookies
Reads the cookies your server sets on the first visit and rates each one: Secure, HttpOnly, SameSite, prefixes, lifetime and analytics cookies without consent.
Check Separately - 06Weight 10
Embedded Content
Does your HTTPS page still load scripts, images or forms over HTTP? And are scripts from third-party servers protected with subresource integrity? With a grade and a list of findings.
Check Separately - 07Weight 5
security.txt
Checks whether your website publishes a valid reporting channel for vulnerabilities according to RFC 9116. With a generator for your own file, directly in the browser.
Check Separately
QUESTIONS
Good to Know.
What does the website security check test?
Seven areas in one run: security headers, SSL/TLS, email security (SPF, DKIM, DMARC, MTA-STS), DNS security (DNSSEC, CAA, name servers), cookies, embedded content (mixed content, Subresource Integrity) and security.txt. Each area also has its own check with all the details.
How is the overall grade calculated?
Each area gets its own grade from A+ to F and a score from 0 to 100. The overall grade is the weighted average score: headers 25, SSL/TLS 20, email 20, DNS 10, cookies 10, content 10 and security.txt 5. If one of the core areas has a critical finding, the overall grade is C at best; a missing security.txt alone only lowers the score. An area that could not be checked does not count.
Is the check a penetration test?
No. The check only reads what your website and your DNS deliver publicly, as a browser or mail server does too. It does not try out vulnerabilities, submits no forms and scans no ports. For a penetration test, talk to us.
Why does the check take up to 30 seconds?
The seven areas run at the same time but take different amounts of time: the TLS check opens several connections with different protocol versions, and the email check queries numerous DNS records. If an area takes longer than 30 seconds, it appears as not checked.
Does TOMORIS store my input or the result?
No, not permanently. The result stays in memory for five minutes and is deleted after six minutes at the latest. Details are in the privacy policy in the Toolbox section.
TOOLBOX
More
Tools.
Security Header Check
Checks HTTPS, HSTS, Content-Security-Policy, clickjacking protection and other headers of your website. With a grade from A+ to F and ready-made configuration.
ViewSSL/TLS Check
Checks the certificate, chain and remaining validity, which TLS versions your server accepts and whether the encryption offers forward secrecy. With a grade and configuration.
Viewsecurity.txt Check
Checks whether your website publishes a valid reporting channel for vulnerabilities according to RFC 9116. With a generator for your own file, directly in the browser.
View
YOUR NEXT STEP
You Have the Result.
What Comes Next?
We assess findings, prioritize by risk and put changes into practice on request: as a project with EXPERTS or as ongoing operations with GRID.