A4IT Scan

Free security check

Website & email security scan

Enter a domain and choose what to check. You get a score out of 100 and a plain-English fix for every issue found.

Just the name, like example.com. A full web address works too.

What to check

Public scans aren’t saved; results stay in this tab. To run the checks, the domain you enter goes to the site itself, Cloudflare DNS, crt.sh and rdap.org (which passes it on to the registry for the domain and its IP address). The bot check is Cloudflare Turnstile. To limit each visitor to 10 scans an hour, we keep a keyed hash of your IP address for 24 hours.

Questions

What does the website security scan check?

It checks that the site redirects to HTTPS and its certificate is accepted, which security headers it sends (HSTS, Content-Security-Policy, X-Frame-Options and others), its cookies and CORS rules, the certificates listed in public CT logs, DNSSEC and CAA records, the software it reveals, and who hosts and registers it.

What does the email security scan check?

It reads the DNS records that protect the domain’s email: MX and SPF (which servers may send its mail), DKIM signing keys across 18 common selectors, the DMARC policy and where its reports go, MTA-STS and TLS-RPT for encrypted delivery, and DNSSEC, CAA and BIMI. It never sends an email.

How is the security score worked out?

Every scan starts at 100. Each issue takes off points by severity: critical 30, high 15, medium 7 and low 3. Notes marked info cost nothing. 90 or more is grade A, 75 is B, 60 is C and 40 is D; anything lower is F. Checks that couldn’t run are left out, and the result says so.

What happens to the domain I scan?

Public scans aren’t saved: the results live in your browser tab and are gone when you close it. To run the checks, the domain goes to the site itself, Cloudflare DNS, crt.sh and rdap.org. We keep a keyed hash of your IP address for 24 hours to limit each visitor to 10 scans an hour.

What can’t this scan check?

It doesn’t test which TLS versions or cipher suites a server accepts, because a Cloudflare Worker can’t make raw TLS connections. It isn’t a penetration test either: it reads public settings and records, and it never logs in, submits forms or tries to break anything. A clean score means a sound setup, not proof of security.