Website & email check
Type a website address you own or look after. In about twenty seconds you get a colour for each check, one sentence on why it matters and, if something needs work, a way to ask us to fix it.
Free, and limited to a few checks an hour so it stays fast for everyone.
What we look at
Your email
- Where your email gets delivered
- Can someone send email pretending to be you?
- Is your email signed, so inboxes can tell it's really from you?
- Do you tell inboxes what to do with fakes, and get reports about them?
Your website
- Is your website's padlock valid, and when does it run out?
- Does it still accept old, weak connections?
- Are visitors always sent to the secure, padlocked version?
- Is it protected against common tricks, like being hidden inside another site?
- Are its cookies locked down?
Your domain name
- Is your domain's address book protected from tampering?
- Have you said which companies may make your padlock?
- Have any private files been left out on show?
- Can people tell you about a security problem?
What we don't do
We only look from the outside, the way a browser or an inbox would. We don't try to break in, guess passwords or hunt for weak spots. We look at your home page and five places where private files are often left by mistake, and nothing else. We also refuse any address that points inside a private network, so nobody can use the check to look where they shouldn't.
What we keep
- Your result
- Kept for 30 days at a private web address that search engines don't list, then deleted. We don't publish a list of the websites people check.
- About you
- A scrambled copy of your internet address that can't be turned back into it, with the website you checked and the time. We keep it for one day, only to apply the limits and stop misuse. No cookies, no tracking, nothing loaded from other companies.
- If you ask us to fix something
- What you type in the form, kept for up to 183 days so we can answer you. See Legal & privacy.
For your IT person
What is checked
- Email: MX (where mail goes); SPF (syntax, the ten-lookup limit,
~allversus-all); DMARC (policy, reports address, percentage, inherited policies for subdomains); DKIM (keys under the common selectors: Google, Microsoft, Proton and others). - Website: certificate issuer and expiry; whether TLS 1.0 or 1.1 is still accepted; HTTP to HTTPS redirect and HSTS; Content-Security-Policy, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and frame protection; cookie flags on the home page.
- Domain and exposure: DNSSEC and CAA; five common leftovers (
/.git/HEAD,/.env, a WordPress config backup, Apache's status page,.DS_Store), a HEAD request each, and "exposed" only when the first kilobyte really is that file;/.well-known/security.txt.
How
Passive and read-only: no port scans, no login attempts, no vulnerability probes, no crawling beyond the home page and the five fixed paths. We resolve the name ourselves and refuse anything that points at a private or internal address.
Limits
Up to 10 checks an hour per connection and 3 an hour per domain; a domain's result is reused for 24 hours. The check runs on a small machine, so there is also an overall limit of 60 checks an hour and 300 a day.
What is stored
The result, under an unguessable token, not indexed, 30 days. For the rate limit and abuse handling: a salted one-way hash of the connection address, the domain and the time, one day; the service's own log lines (time, that hash, the domain) 14 days.
Talk to a person
These services are run by little jamjar in the UK. Email hello@littlejamjar.com. Replies within two working days.