AttackerView

Ask "is example.com secure?" and AttackerView runs a passive security check of the domain in a few seconds. No account or login needed.

What it checks:

• Security headers, Content Security Policy and clickjacking protection
• HTTPS: the HTTP to HTTPS redirect and the TLS configuration
• DNS, DNSSEC and CAA records
• Email authentication: SPF, DKIM, DMARC and MTA-STS

Each issue comes with its severity, the evidence and how to fix it, plus a link to a fix guide where one exists.

The check makes one request to the homepage plus DNS and TLS lookups. It does not log in, crawl or send attacks, so it cannot find vulnerabilities in the application itself. For that, run a full AttackerView scan.