SurfaceWatch - Website Security Checker: Headers, SSL & SPF/DMARC

One-click website security checker - get an A-F grade for headers, SSL, cookies & SPF/DMARC, with copy-paste fixes.

SurfaceWatch is a one-click website security checker built for freelancers, developers and small agencies who look after client websites. Open any page, get an A-F security grade in about a second, understand every finding in plain English, and copy the exact fix - without needing five separate tools. WHY SURFACEWATCH Most "security header" checkers grade one slice of a site and stop. SurfaceWatch checks six layers of a site's real attack surface and turns them into one clear grade with a prioritised, plain-English to-do list - and a client-ready report you can hand straight to a client. SECURITY AT A GLANCE Every report now opens with a six-area scorecard - HTTPS, security headers, cookies, email, page content and attack surface - so you and your client see exactly where the problems are in one look. A plain-English summary explains what the grade means, and a check that could not complete reads "Not fully checked" instead of pretending everything is fine. WHAT IT CHECKS - HTTPS and SSL: HTTPS in use, HTTP-to-HTTPS redirects, and HSTS. - Security headers: Content-Security-Policy quality, clickjacking protection, and the other recommended security headers. - Cookies: login and session cookies missing the Secure, HttpOnly or SameSite flags. Cookie values are never read. - Email spoofing: SPF and DMARC records, plus CAA - the DNS records that make it much harder to spoof email from a domain. - Page content: mixed content, forms that submit over HTTP, third-party scripts without Subresource Integrity, and outdated JavaScript libraries with known vulnerabilities. - Attack surface: subdomains pulled from public Certificate Transparency logs, with admin, dev and staging systems flagged, plus leaked software versions where available. A COPY-PASTE FIX FOR EVERY ISSUE Every finding is ranked by severity and explained in plain English - what it is, why it matters, and the exact configuration to fix it. Pick your stack and copy the ready-made snippet for your web server, hosting platform or DNS provider. One click can generate a single snippet that adds every missing security header at once. FREE - Unlimited one-click security checks, with the full fix for every issue - The six-area scorecard, plain-English summary and A-F grade - Watch 1 site with daily re-checks and alerts - See 3 subdomains per site - Preview the Pro client report, as a watermarked sample, so you can see the deliverable before you upgrade SURFACEWATCH PRO - $7 per month or $59 per year, with a 7-day free trial - White-label PDF reports with your logo, your client's name, a plain-English summary and a score-history chart - Watch up to 25 sites, re-checked daily, with alerts when a score drops, a new issue appears, or a new subdomain shows up - Bulk-check up to 25 sites at once and export the results as a spreadsheet (CSV) - Every subdomain revealed, plus JSON export for your own tooling BUILT FOR CLIENT WORK Check a site before launch, review a client site, investigate a configuration issue, or keep an eye on every client website you manage - then hand over a report with your own branding on it. SCOPE SurfaceWatch checks the page you open plus the domain-level signals its checks can reach. It does not automatically crawl every URL on a website. Subdomain discovery relies on public certificate-log data and can be incomplete or briefly unavailable. The A-F grade is a configuration assessment, not a guarantee that a site is completely secure. PRIVATE BY DESIGN Checks run in your browser. SurfaceWatch has no server of its own, no analytics and no account to create. Cookie values and page content never leave your browser. A few checks contact public DNS and certificate-log services with the domain name being checked, and Pro licensing uses its payment provider. Every check is passive - it only reads what a site already shows every visitor, so it is safe to run on sites you do not own. Grade your first page in one click - install SurfaceWatch and see where a site really stands.