Free · external · no account

Free Website Security Scan

Check your website's security in around 60 seconds.

Run a non-invasive external security check covering SSL/TLS, website configuration, WordPress exposure, security headers, DNS/email security and other externally visible risks.

  • No plugin.
  • No server access.
  • No credit card.
  • No Astrari account required.

We'll use your email to deliver and retain your scan result. We won't add you to marketing unless you opt in. Privacy policy. Non-invasive: one page load, a TLS handshake and DNS lookups — no login attempts, no probing.

01 · Observe

What the free scan checks

Every check is one a careful visitor could make: a page load, a handshake, a DNS query. The report tells you what we observed, why it matters and what to change — grouped so you can hand it to whoever runs the site.

Website & HTTPS

  • HTTP → HTTPS redirect
  • Certificate validity, hostname and expiry
  • TLS protocol posture (TLS 1.0/1.1 disabled?)
  • Certificate key strength and signature
  • Mixed content on the homepage

Security headers

  • Strict-Transport-Security (HSTS)
  • Content-Security-Policy
  • Clickjacking protection (X-Frame-Options / frame-ancestors)
  • X-Content-Type-Options, Referrer-Policy, Permissions-Policy
  • Cookie Secure / HttpOnly / SameSite flags

WordPress

  • WordPress detected, core version if disclosed
  • Plugins and themes your homepage references
  • Known vulnerabilities (CVEs) for identified versions
  • Core vulnerabilities including WP2Shell
  • Version disclosure
  • Not included: outdated-version checks and the full plugin inventory — those come with monitoring

DNS & email

  • SPF presence and strength
  • DMARC policy (none / quarantine / reject)
  • DMARC reporting (rua)
  • DNSSEC
  • MX presence

Reputation

  • Spamhaus DBL and SURBL blacklists
  • Domain registration expiry
  • SEO-spam keywords and hidden links
  • Scripts loaded from bare IP addresses
  • Third-party script hosts

02 · Measure

How it works

  1. Step 1

    Enter your website

    Your address, first name and a business email so we can send the report. Confirm you're authorised to assess the site.

  2. Step 2

    We look from the outside

    The scan runs in its own queue: HTTPS, certificate, headers, DNS, WordPress components, known vulnerabilities, reputation. Progress is real — each step reports as it finishes.

  3. Step 3

    Read the report

    A 0–100 security score using the same model as Astrari's monitoring, findings by severity with plain-English fixes, and every check that passed.

What an external scan can't see

A snapshot from the outside, honestly labelled

The free scan never touches your server. It cannot see malware in files, outdated operating-system packages, inactive plugins that aren't referenced on the homepage, weak admin credentials, database injections or file changes. Where a check couldn't run, the report says so rather than guessing.

03 · Protect

Astrari watches continuously

Monitored websites are re-checked on a schedule and you're alerted when something changes: new WordPress vulnerabilities, uptime, TLS and DNS changes, defacement, security headers, JavaScript supply-chain changes, blacklists, exposed files, domain expiry. Verified ownership unlocks the deeper checks the free scan deliberately leaves out.

See what monitoring adds →

FAQ

Questions people ask before they run it

What does the free security scan check?
It reviews what is visible from outside: HTTPS and certificate health, TLS protocol posture, security headers and cookie flags, SPF/DMARC/DNSSEC, blacklist status, domain expiry, and — for WordPress sites — the core version and the plugins and themes your homepage references, matched against known vulnerabilities.
Is the scan safe?
Yes. It is deliberately passive: one page load with a normal browser-style request, a TLS handshake, DNS lookups, and for WordPress a look at the public version files of components your homepage already links to. There are no login attempts, no path guessing, no injected payloads and no port scanning.
Do you need access to my server?
No. Nothing is installed and no credentials are needed. The free scan only sees what any visitor on the internet can see. Astrari's optional server agent, used by monitored customers, adds server-side visibility later if you want it.
Does this work with WordPress?
Yes. If WordPress is detectable from the homepage we identify the core version (when disclosed), the active plugins and themes referenced in the page, and check identified versions against the Wordfence Intelligence vulnerability database. Components whose version isn't public are listed so you can verify them.
What can't an external security scan detect?
Anything only visible from inside the server: malware in files, outdated operating-system packages, weak admin passwords, inactive plugins that aren't referenced on the homepage, file changes, database injections and misconfigured permissions. That is what continuous monitoring with the Astrari agent is for.
How is Astrari different from a one-time scanner?
A one-time scan is a snapshot. Astrari watches continuously — WordPress vulnerabilities as they're published, uptime, TLS and DNS changes, defacement, blacklist status, JavaScript supply-chain changes — and alerts you when something changes, with a monthly report you can hand to a client.

For agencies

Manage client websites?

Use Astrari to monitor multiple WordPress sites, hosting accounts and Linux servers from one place — client grouping, scoped client logins and branded monthly reports.

Try Astrari With 5 Client Websites