SurfaceWatch – Website Security Checker

Grade any website's security in one click: headers, cookies, SPF/DMARC and subdomains, with copy-paste fixes for your platform.

SurfaceWatch grades any website's security from A to F in one click, then tells you exactly how to fix every issue it finds. It goes beyond security headers: cookies, email spoofing protection, outdated JavaScript libraries and publicly listed subdomains are all checked, with most results in about a second. WHAT IT CHECKS • HTTPS: HTTPS in use, HTTP to HTTPS redirects and HSTS • Security headers: Content Security Policy quality, clickjacking protection and the other recommended headers • Cookies: login and session cookies missing the Secure, HttpOnly or SameSite flags • Email spoofing: SPF and DMARC records, plus CAA • Page content: mixed content, forms that send data over HTTP, third-party scripts without integrity checks, and outdated JavaScript libraries with known vulnerabilities • Attack surface: subdomains from public certificate logs with admin, dev and staging systems flagged, plus software version leaks A COPY-PASTE FIX FOR EVERY ISSUE Every issue is ranked by severity and explained in plain English, with the exact configuration to fix it for your web server, hosting platform or DNS provider. One snippet can fix every missing security header at once. WORKS WHERE YOU WORK • Any website, including staging and local development sites • The grade appears on the toolbar icon for sites you've checked • See how the score changed since the last check • Light and dark mode FREE • Unlimited one-click checks with fixes • Watch 1 site with daily alerts • See 3 subdomains per site SURFACEWATCH PRO ($7/month or $59/year, with a 7-day free trial) • Watch up to 25 sites, re-checked daily, with alerts when a score drops, a new issue appears or a new subdomain shows up • White-label PDF reports with your logo, your client's name, a plain-English summary page and a score history chart • Bulk check up to 25 sites at once and download the results as a spreadsheet (CSV) • Every subdomain, plus JSON export PRIVATE BY DESIGN Checks run in your browser. SurfaceWatch has no server, no analytics and no account. Cookie values are never read. Every check is passive: it only reads what a site already shows every visitor, so nothing is scanned or probed. Built for web agencies, freelancers, developers and small teams who look after websites without a full-time security person.