Home / What we check

What we check (outside-in)

We look at public signals a stranger on the internet can already see. No logins. No scanning that tries to break in.

Whether public DNS records make it harder for scammers to send mail that looks like your business.

Whether visitors get a lock, whether HTTP redirects to HTTPS, and when the certificate expires.

Basic browser protections (like framing and content-type sniffing defenses) that many small sites skip.

Public CMS or plugin clues that attackers can look up — not a deep inventory of your private systems.

Renewal risk from public WHOIS/RDAP data so a lapsed domain does not surprise you.

Have I Been Pwned domain search with owner verification — paid checkup only, not the free snapshot.

Deeper testing only with written permission. Public checks until you authorize more in writing.

Does this touch our computers or email accounts?

No. The free snapshot uses public DNS, certificate, and HTTP response information only.

Is this a penetration test?

No. Penetration testing or other deeper work is optional and only happens after written permission with a clear scope.