Everything we look at, and who it is about.
169 checks, in plain words, generated from the Cents Security scanner itself. A free scan runs 41 of them on any address and shows every result in full.
25 of the rest ask a server for things an ordinary visitor never requests, so they wait until you prove the domain is yours. Paying does not change that. Owning the domain does.
All 169 checks.
A customer47 checks
Everything here decides whether they stay, and most of it they notice without knowing they noticed.
Looking like a real business
- Blocklists and browser warningsFree
- Browser tab iconBusiness
- Contact informationFree
- Form spam protectionFree
- Form submission safetyFree
- Forwarding to any addressafter you prove it is yoursBusiness
- Holding pageFree
- Links to insecure pagesBusiness
- Opening hoursBusiness
- Physical addressBusiness
- Reviews and ratingsBusiness
- Site freshness signalsBusiness
- Tap to callFree
- Text encoding declarationBusiness
- Unfinished template textFree
- Where form submissions goBusiness
The padlock and the connection
- Certificate coverageBusiness
- Certificate expiryFree
- Certificate key sizeBusiness
- Certificate lifetimeBusiness
- Certificate matches the addressFree
- Certificate signature strengthBusiness
- Certificate trustFree
- Current encryption versionBusiness
- Insecure address redirectsBusiness
- Insecure items on a secure pageFree
- Old encryption versionsBusiness
- Secure connectionFree
- Stay-secure coverageBusiness
- Stay-secure instructionBusiness
- Stay-secure instruction lengthBusiness
Speed
- Browser cachingBusiness
- Connection protocolBusiness
- Image sizesBusiness
- Mobile displayFree
- Page weightFree
- Production build qualityBusiness
- Response compressionBusiness
- Server response speedFree
Usable by everyone
- Form autofill hintsBusiness
- Form labelsFree
- Heading orderBusiness
- Image descriptionsFree
- Link descriptionsBusiness
- Page languageFree
- Pinch to zoomBusiness
- Skip to contentBusiness
A search engine, or an assistant answering for you12 checks
Everything here decides whether anyone arrives at all, including the growing share of people who ask an assistant instead of searching.
Being found
- AI assistant visibilityFree
- Business information for search enginesFree
- Competing page headingsBusiness
- Crawler instructionsFree
- Duplicate address handlingFree
- How your links look when sharedFree
- Main page headingBusiness
- Page auto-forwardingBusiness
- Page titleFree
- Search engine accessFree
- Search result descriptionFree
- Site mapFree
Somebody looking for a way in92 checks
Everything here is a door. Some of them lead to your site, and some let a stranger invoice your customers using your name.
Things that should not be public
- Administration login pageafter you prove it is yoursBusiness
- API documentationafter you prove it is yoursBusiness
- API schema disclosureafter you prove it is yoursBusiness
- Application log fileafter you prove it is yoursBusiness
- Application management endpointsafter you prove it is yoursBusiness
- Cloud provider credentialsafter you prove it is yoursBusiness
- Code that builds and runs new codeBusiness
- Code that inserts unchecked HTMLFree
- Configuration file backupsafter you prove it is yoursBusiness
- Configuration file with passwordsafter you prove it is yoursBusiness
- Credentials kept in the browserFree
- Database export left in the openafter you prove it is yoursBusiness
- Developer notes in the bundleBusiness
- Developer notes in the pageBusiness
- Editor and deploy settingsafter you prove it is yoursBusiness
- Email address exposureBusiness
- Folder browsingafter you prove it is yoursBusiness
- Hidden folder indexafter you prove it is yoursBusiness
- How random values are generatedBusiness
- Keys in public codeFree
- Messages from other windowsBusiness
- Original source codeFree
- Package registry tokenafter you prove it is yoursBusiness
- Private key fileafter you prove it is yoursBusiness
- Public cloud storageBusiness
- Security contactBusiness
- Server configuration pageafter you prove it is yoursBusiness
- Software parts listafter you prove it is yoursBusiness
- Source code repositoryafter you prove it is yoursBusiness
- Subversion metadataafter you prove it is yoursBusiness
- Unencrypted addresses in codeFree
- Web server configuration fileafter you prove it is yoursBusiness
- Website backup left in the openafter you prove it is yoursBusiness
- WordPress account listingafter you prove it is yoursBusiness
- WordPress remote interfaceafter you prove it is yoursBusiness
Your domain and your email
- Approved email sendersFree
- Approved sender methodBusiness
- Certificate issuance alertsBusiness
- Certificate issuance controlBusiness
- Domain name server redundancyBusiness
- Domain record signingBusiness
- Domains resembling yoursBusiness
- Email deliveryBusiness
- Email impersonation protectionFree
- Email protection coverageBusiness
- Email protection for subdomainsBusiness
- Email protection reportingBusiness
- Email protection strengthBusiness
- Email record limitsBusiness
- Email sender record validityBusiness
- Email sender rulesBusiness
- Email signingBusiness
- Enforced mail encryptionBusiness
- Lookalike domains that can send emailBusiness
- Mail encryption reportingBusiness
- Mail server redundancyBusiness
- Verified logo in inboxesBusiness
Instructions your site gives browsers
- Address privacyBusiness
- Application software disclosureBusiness
- Clickjacking defenceBusiness
- Content policy framing ruleBusiness
- Content policy source listBusiness
- Cross-site data accessBusiness
- Device access limitsBusiness
- Embedded outside pagesBusiness
- File type enforcementBusiness
- Links that open in a new tabBusiness
- Script injection defenceFree
- Script policy strengthBusiness
- Software version disclosureBusiness
- Which commands your server acceptsafter you prove it is yoursBusiness
- Which sites may read your dataafter you prove it is yoursBusiness
Outside code your site runs
- Add-on list and versionsBusiness
- Code we could not identifyBusiness
- Debug code in the live siteFree
- Known-vulnerable componentsBusiness
- Outside code from dead domainsFree
- Outside code providersBusiness
- Outside script verificationBusiness
- Published weaknesses in the code you loadBusiness
- Published weaknesses on your serverBusiness
- Retired browser featuresBusiness
- Website software versionBusiness
- Whether your code could be readFree
Hosting and registration
- Abandoned service pointersBusiness
- Databases reachable from the internetBusiness
- Domain renewalFree
- Domain transfer lockBusiness
- Forgotten sites on your domainBusiness
- Outdated network servicesBusiness
- Remote control servicesBusiness
- The www version of your addressBusiness
A regulator, or somebody's solicitor18 checks
Everything here is a rule somebody can hold you to. We cite the rule and never tell you whether you comply, because that is a lawyer's job.
Legal pages and rules
- Accessibility statementBusiness
- Consent before trackingFree
- Cookie detail behind the bannerBusiness
- Cookie policy linkBusiness
- Privacy policyFree
- Privacy policy accuracyBusiness
- Refund and returns policyBusiness
- Terms and conditionsBusiness
- Where form submissions goBusiness
Tracking and privacy
- Advertising pixelsBusiness
- Cookie cross-site rulesBusiness
- Cookie lifetimesBusiness
- Cookie protectionBusiness
- Cross-site cookie safetyBusiness
- Embedded content privacyBusiness
- Fonts loaded from GoogleBusiness
- Login cookie protectionBusiness
- Screen recordingBusiness
See which of these your site fails.
The list says what we look for. A scan says what we found, and what each one costs.
Check a website