Orchords Security Scan

Scan public website security signals

A free, self-serve report on public security signals for a reachable site — HTTPS and HSTS, security headers and CSP, DNS and email authentication, and information exposure. The result is informational and should not be treated as an audit, certification, penetration test, or legal compliance determination.

Passive and non-intrusive

This scan only reads what a reachable site already serves publicly — response headers and public DNS records. It performs no exploitation, credentialed access, destructive testing, or intrusive probing.

What the free scan checks

Transport security — HTTPS and HSTS (Strict-Transport-Security)
Security headers — CSP, clickjacking protection, nosniff, referrer and permissions policy
Information exposure — server/stack version leakage and fingerprinting
DNS & email authentication — SPF, DMARC, DNSSEC and CAA

Need more context?

If you want to discuss a domain you own or are authorised to assess, use the contact form and keep the first message non-confidential. Any broader review would need written scope, authority, limits, and legal permission before work starts.

Need more context? →