SurfaceWatch - Website Security Checker: Headers, SSL & SPF/DMARC

One-click website security checker - get an A-F grade for headers, SSL, cookies & SPF/DMARC, with copy-paste fixes.

SurfaceWatch is a one-click website security checker that grades any site from A to F - then shows you the exact copy-paste fix for every issue it finds. Most checks finish in about a second. It goes far beyond a security-headers scan. SurfaceWatch inspects six layers of a site's real attack surface - HTTPS, security headers, cookies, email spoofing, page content and exposed subdomains - and turns them into one clear score with a prioritised, plain-English to-do list. WHY SURFACEWATCH Most "security header" checkers grade one slice of your exposure and stop. A green header score can still hide spoofable email, session cookies missing the Secure flag, an outdated JavaScript library with a known CVE, or a forgotten admin subdomain. SurfaceWatch checks all of it in a single pass, so the grade reflects your whole website - not just its response headers. WHAT IT CHECKS • HTTPS & SSL: HTTPS in use, HTTP-to-HTTPS redirects, and HSTS so browsers never downgrade the connection • Security headers: Content-Security-Policy (CSP) quality, clickjacking protection, and the other recommended security headers • Cookies: login and session cookies missing the Secure, HttpOnly or SameSite flags (cookie values are never read) • Email spoofing: SPF and DMARC records, plus CAA - the DNS records that make it much harder to spoof email from your domain • Page content: mixed content, forms that submit over HTTP, third-party scripts without Subresource Integrity, and outdated JavaScript libraries with known vulnerabilities • Attack surface: subdomains pulled from public Certificate Transparency logs, with admin, dev and staging systems flagged, plus leaked software versions A COPY-PASTE FIX FOR EVERY ISSUE Every finding is ranked by severity and explained in plain English - what it is, why it matters, and the exact configuration to fix it. Pick your stack and copy the ready-made snippet for your web server, hosting platform or DNS provider. One click can generate a single snippet that adds every missing security header at once. No guesswork, no copy-pasting from five different blog posts. WORKS WHERE YOU WORK • Check any website - production, staging or local development • The A-F grade appears right on the toolbar icon for every site you've checked • See exactly how the score changed since your last check • Clean, fast interface with light and dark mode FREE • Unlimited one-click security checks, with the full fix for every issue • Watch 1 site with daily re-checks and alerts • See 3 subdomains per site SURFACEWATCH PRO - $7/month or $59/year, 7-day free trial • Watch up to 25 sites, re-checked daily, with alerts when a score drops, a new issue appears, or a new subdomain shows up • White-label PDF reports with your logo, your client's name, a plain-English summary page and a score-history chart • Bulk-check up to 25 sites at once and export the results as a spreadsheet (CSV) • Every subdomain revealed, plus JSON export for your own tooling BUILT FOR Web agencies, freelancers, developers and small teams who look after client websites without a full-time security person - and anyone who wants to know, in one click, whether a site is actually configured safely. PRIVATE BY DESIGN Checks run entirely in your browser. SurfaceWatch has no server, no analytics, no tracking and no account to create. Cookie values are never read. Every check is passive - it only reads what a site already shows every visitor, so nothing is ever scanned, probed or attacked. It's safe to run on sites you don't own. The A-F grade reflects the checks SurfaceWatch performs - a configuration assessment, not a guarantee that a site is completely secure. Grade your first site in one click - install SurfaceWatch and see where your website really stands.