Free · no contact details
Is your website OK right now?
Enter an address and we check what is visible from the outside in under 30 seconds. You see the full result on this page.
We only look at the front page the way a normal browser does. No admin path probing, no attacks. Up to 5 checks a day.
Risk of going down
- SSL certificate — Once it expires, browsers show a 'Not secure' warning and most visitors leave.
- Domain expiry — A missed renewal takes the site and email down together, and someone else can take the name.
- Response — If the first response takes over 3 seconds, many mobile visitors will not wait.
- http → https redirect — Visitors arriving on http see a 'Not secure' label unless they are sent to https.
Security exposure
- Server / PHP version exposure — End-of-life versions get no security patches, and a visible version helps attackers pick an exploit.
- Security headers — Without HSTS or frame protection the basic defences against interception and clickjacking are missing.
- Site engine (CMS) — Outdated engines are no longer fixed and become a way in.
- Mixed content — An https page loading scripts over http gets blocked by browsers and can be tampered with in transit.
- External scripts — Known malicious relays or hidden loader code are signs of a compromise that pushes fake apps to visitors.
Mobile · speed
- Mobile layout — Without a mobile viewport text is tiny on phones and search ranking suffers.
- Front page weight — Over 5MB takes long to open on mobile data.
- Google mobile speed score — Google's own score. Below 50 also hurts search visibility.
Search visibility
- Title · description — This is the text shown in search results. Without it search engines pick random text.
- Share preview — Links shared on messengers and social media show no title or image.
- Search blocking (robots.txt) — A block-all rule keeps the site out of Google and Naver entirely.
- Sitemap — Tells search engines which pages exist. Without it new pages are found late.
What cannot be seen from outside
Even if everything above is green, these can only be checked from inside the server. For a site whose developer has gone silent, this is where the real risk is.
- Who holds the server accounts and access
- Whether database backups actually run and can be restored
- Whether you have the source code
- When the admin passwords were last changed
- Signs of an existing compromise (web shells, hidden accounts)
Ask what the result means
We measure the server, source and database first, then tell you what to fix and what it costs.