What the standard says
Looking at a business from the outside is a recognized first step. CISA runs a vulnerability scanning service that checks organizations’ internet-facing systems for known weaknesses and configuration mistakes, using non-intrusive checks [1]. Our Free Security Assessment follows the same idea on a smaller scale. We look up what public sources have already recorded, and we visit your public home page once, the same way any customer would.
What we look at:
Email authentication: SPF, DKIM, DMARC, and the optional MTA-STS, TLS-RPT and DNSSEC [2][3].
Domain registration: renewal date, transfer lock, and who the domain is registered to [4].
Certificates and encryption: your website certificate, when it expires, and old subdomains still listed in public certificate logs [5].
Your website, from one ordinary visit: hosting, site platform and version, common security headers and accessibility. For medical practices, tracking pixels on patient-facing pages [6][7][8][9][10].
Lookalike domains: similar domains that are registered and set up to send email [11].
Phone and business listings: whether your number matches across your site and listings, plus a port-out PIN reminder and a check on your phone system’s admin login [12].
Business presence: your Google Business Profile and, for some industries, public registries [12].
Public exposure: staff email addresses published on your site, and documents search engines have indexed.
Internet-facing services, like remote access or camera systems, but only when we know your office’s internet address and it’s a business connection [13][14].
An account checklist in every report: MFA, how many admin accounts you have, mailbox forwarding rules, and third-party app access.
A person on our team reviews every result and writes the report. It isn’t an automated scan sent as-is. Every observation lists its source and date, and the original records are attached as exhibits, so your IT person can check them independently.
What you’ll hear
“A free security scan is just a sales pitch,” or the reverse: “Your report came back clean, so you’re secure.”
Both miss something. A free review does lead to a conversation, and we’re upfront about that. But the findings stand on their own, with sources attached and links to neutral pages like this one, so you can fix them with anyone. And a clean outside view isn’t a clean bill of health. From the internet we can’t see your computers, backups, Microsoft 365 or Google Workspace settings, or how your network is set up. That takes a full security assessment, done only with your written permission.
What the numbers say
We don’t quote outside statistics on this page. Once we’ve done enough assessments, we’ll share counts of what we find most often.
What we’ve seen
We haven’t run into this yet.
Putting it together
The Free Security Assessment shows you what’s already visible to anyone who looks, explained in plain language, in about two business days. Many of the items it raises are common and simply easier to spot from the outside. It’s a fair look at your outside, not a full security review.
What good looks like
Email authentication set up and passing.
Your domain renewing on time, locked, and registered to the business.
Current certificates and an up-to-date website platform.
Nothing open to the internet that doesn’t need to be.
MFA and tidy admin access confirmed on the account checklist.
Questions for your IT resource
Have we ever had an outside view of our domain, email and website?
Which of these items would you expect to come back clean?
When did we last have a full security assessment?
Related learning
How to read your Free Security Assessment
Your Free Security Assessment starts with what’s working well, then lists each item worth confirming with how sure we are and how soon it’s worth handling. This page explains each part so you can read it on your own.
What is MFA, and why a password isn’t enough
MFA, short for multi-factor authentication, asks for a second proof after your password, like a prompt on your phone or a security key. A stolen password alone is no longer enough to sign in.
What is DMARC?
DMARC is a DNS record that tells other mail servers what to do with email that claims to come from your domain but can’t prove it.
Sources
CISA, CISA Vulnerability Scanning. (checked 2026-10-07)
PowerDMARC, DMARC Analyzer. (checked 2026-10-07)
domainaware, checkdmarc. (checked 2026-10-07)
ICANN, ICANN Lookup. (checked 2026-10-07)
SSLMate, Cert Spotter Certificate Transparency Search API. (checked 2026-10-07)
Web Check, Web Check. (checked 2026-10-07)
Google, About PageSpeed Insights. (checked 2026-10-07)
Google Cloud, Web Risk. (checked 2026-10-07)
Wordfence, Wordfence Intelligence. (checked 2026-10-07)
Retire.js, Retire.js. (checked 2026-10-07)
elceef, dnstwist. (checked 2026-10-07)
Google, Places API overview. (checked 2026-10-07)
Netlas, Netlas. (checked 2026-10-07)
ipapi.is, ipapi.is. (checked 2026-10-07)
How we rate these. Our judgment from real setups, applied the same way on every page. Cost: $ = no new spend or under $25/month · $$ = a modest monthly tool or a short project · $$$ = new hardware, licensing, or a larger project. Effort: Light = one sitting · Moderate = setup plus follow-up over days or weeks · Heavy = planning, testing and staff changes. Outlined marks show how far it can go for some businesses. N/A = doesn’t apply to this topic. Time to fix: how long the first useful step takes, then how long until it’s fully done. Ratings are typical averages, not quotes. Time to fix: the filled dot is when the first useful step lands, the hollow dot is when it’s fully done. Who can do it: highlighted chips are who can reasonably handle it.