Why this tool
Who this is for, and who it isn't.
A tool that promises everyone everything usually does nothing well. Here is when it is worth entering your address, and when it is only fair to say you will get more elsewhere.
It is for you if
The situations where this gives you an answer you would otherwise assemble from four sources.
- someone else built your site and you do not know exactly what is inside it
- you are not sure whether someone can send mail in your name
- you received a message that looks like it is from your bank, your boss or a supplier
- you want to know where you stand before you pay someone to fix it
- someone asked whether your site is GDPR compliant and you are not sure what it actually does
- you run a small company with no IT department of its own
Enter your address. The findings are complete, free and yours.
Better elsewhere if
For any single item there is a better tool than this one, and there is no point pretending otherwise.
- you need continuous monitoring, history and alerts when something changes Detectify, Qualys, Intruder — paid
- you only care about the TLS certificate and ciphers SSL Labs — more thorough than I am
- you only want a grade for your security headers securityheaders.com — three seconds, free
- you run WordPress and want to go all the way WPScan — needs a command line and an API key
- you need a privacy check that gives a legal opinion this gives technical observations — a lawyer gives the verdict
- you need a deep test with an agreed scope that is not a tool but a job that gets contracted — services
Go straight there — it will be faster and more thorough.
If you are in the left column, here is what you get.
- Four checks in one place.
Another site's legitimacy, your site's vulnerabilities, email and GDPR. You do not need to know which tool covers which item, or stitch several reports into one.
- No account, no trial, no card.
There is no subscription to cancel. The site-vulnerability and GDPR checks need an email confirmation on the domain being checked, so it is known the site is yours. The email check and the legitimacy check do not even need that.
- The findings are signed with a name.
Not “automated security platform”. If something makes no sense, or you think it is a false positive, there is someone to ask — and the reply comes from the person who wrote the tool.