Free technology checkup
How healthy is your business technology?
Enter your domain. In about 20 seconds you’ll see how your email security, website, domain protection and speed stack up, in plain English, with what we’d fix first.
Example report
yourbusiness.com
4 things worth a look
- Nothing stops forged email from your domain
- HSTS isn’t enabled
- Valid security certificate
- Email runs on Microsoft 365
What we check
Four things that matter, checked from the outside.
Email security
- Who is allowed to send as you (SPF)
- Whether forged email gets blocked (DMARC)
- Digital signatures (DKIM)
- Encrypted delivery (MTA-STS)
- Your mail provider
Website security
- HTTPS and the security certificate
- Security headers browsers rely on
- Insecure content and cookies
- Hosting, CDN and website platform
Domain protection
- DNSSEC signing
- Transfer lock and renewal date
- Nameserver redundancy
- Which authorities can issue certificates
Speed and availability
- Server response time
- Page weight and compression
- Phone readiness
- Image loading
What we don’t do
Public information only.
- No logins, passwords or account access
- No port scanning or probing for weaknesses
- No crawling your site. One homepage visit.
- No emails sent to you or your domain
How the score works
Weighted by what hurts most.
Each area is scored out of 100, then combined. Email counts most because forged email is how most payment scams start. Anything we couldn’t check is left out rather than counted against you.
- Email security35%
- Website security30%
- Domain protection15%
- Speed and availability20%
Questions
About the checkup
Is this safe to run on my domain?
Yes. We only look at information that’s already public: your DNS records, one normal visit to your homepage, your security certificate and public domain registration data. We don’t log in to anything, scan ports or crawl your site.
Can I run it on a prospect’s or vendor’s domain?
You can. It’s the same public information anyone on the internet can see. It’s a useful way to check a vendor before you trust them with email or payments.
Who can see my report?
Each report gets its own unlisted link. It isn’t indexed by search engines or listed anywhere on our site, so only people you share the link with will see it.
Why is something marked “couldn’t check”?
Some things can’t be confirmed from outside, like a DKIM key with a custom name, or a server that didn’t answer in time. Those items don’t count against your score.
My score is high. Am I safe?
It’s a good sign, but this only covers what’s visible from the internet. Backups, passwords, devices and staff training can’t be seen from outside. That’s what our free assessment covers.
Want the inside view too?
The checkup sees what the internet sees. Our free assessment covers the rest: backups, accounts, devices and how your team works.
Prefer email? info@getwittco.com