Website security in plain language

We find the weak spots. And help you fix them.

Enter your website and get a free security report: what we found, how risky it is and what to do about it.

Try it now

Email me if my grade drops or the site goes down I own this site or have permission to test it (also checks for exposed .env, backups, database dumps and admin panels on subdomains) Also measure page speed with Google Lighthouse (~20 s longer)

Scanning…

✓ free scan✓ no sign-up

See a sample report →

How it works

Enter your site

Type your domain. The scan is free and usually takes under a minute.

Get your report card

A graded list of findings, ranked by risk, each with a recommended fix.

Fix it

Follow the step-by-step instructions, or ask us for help.

Broad outside check

Exposed files, security headers, email and DNS settings, known vulnerabilities, blacklists and tracking scripts, checked from the outside without logging in or changing anything.

Plain-language report

Each finding explains the problem, how risky it is and what to do, written for site owners, not just developers.

Help when you need it

Most findings come with step-by-step instructions or a configuration example. If you would rather not do it yourself, email [email protected] and we will take a look.

What we check

All checks run from the outside: nothing is installed or changed on your site.

Encryption & connections

HTTPS availability, HTTP→HTTPS redirects, redirect chains, SSL certificate expiry, mixed content.

Security headers

HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy, including common configuration mistakes.

GDPR & cookies

Tracking scripts (Google, Meta, Hotjar, TikTok…) without a visible consent banner, tracking cookies set before consent, Secure and HttpOnly cookie flags.

Email & DNS

SPF, DMARC and common DKIM selectors (protection against email sent in your name), plus CAA (who may issue your SSL certificate).

Exposed files

Commonly forgotten files: .env, .git, database dumps, backup archives, old config files, phpinfo. Checked only when you confirm you own the site or have permission.

Known vulnerabilities

CISA KEV, NVD, OSV and WPScan lookups for the CMS, PHP, plugin and JavaScript versions we can see, with EPSS exploit forecasts where available.

Reputation & exposure

Spam blocklists (SpamCop, Barracuda, Spamhaus), Google Safe Browsing, open ports on the server IP (Shodan) and subdomains listed in public certificate logs.

Speed & quality

Optional Google Lighthouse audit: performance, accessibility, best practices and SEO — four separate scores.

Why ScanMend

Free scan, no account needed	✓
Plain-language explanations (English and Lithuanian)	✓
Step-by-step fixes, with configuration examples where possible	✓
Help with the fixes	Email us