Would your website and email pass a basic security check?
Up to 22 checks on what attackers see first: your HTTPS, files left exposed on the server, outdated software, and whether scammers can send email as you. Your report is ready in under a minute, with the exact fix for every finding and re-checks that prove the fixes are live.
Find the open doors. Close them. Prove it.
One-time payment · No contract · Nothing to install · Nothing logs in to your site Pay in US dollars with PayPal, or in Chilean pesos with Flow (Webpay, cards).
Four ways a small gap costs real money
A browser warning stops sales
A missing or expired certificate puts a full-page “Not secure” warning in front of your site. Most visitors leave before they ever see your offer.
Scammers can email your customers as you
Without SPF and DMARC, anyone can send an invoice that looks like it came from your domain. Gmail and Yahoo have also required DMARC from bulk senders since February 2024 — without it, your own newsletters land in spam.
One forgotten file can hand over the keys
A leftover .env file, database backup or config copy on the server publishes your passwords to anyone who asks for it. Automated scripts ask every site for these files, all day.
Old software is a public list of weaknesses
Every WordPress and PHP update publishes the holes it fixes. A site that skipped them is running a list attackers already have.
Up to 22 checks in five areas
- Encryption. A valid HTTPS certificate, http:// sending visitors to https://, how many days the certificate has left, HSTS, and no page file still loading over plain http://.
- Browser protections. Content Security Policy, protection against other sites framing yours, nosniff and Referrer-Policy.
- Software and exposed files. Version banners, end-of-life PHP, outdated WordPress, JavaScript libraries with published vulnerabilities (old jQuery, Bootstrap and others), public login names, XML-RPC, downloadable .env, .git, database dumps, config backups and phpinfo pages, and open folder listings.
- Cookies. Login and session cookies flagged Secure and HttpOnly, so they can’t be read by injected scripts or sent unencrypted.
- Email and domain. SPF, DMARC and DKIM — the three records that stop people sending email as you — and how long until your domain expires.
Check, fix, prove
Pay and enter your website
Your private report link reaches your inbox the moment the payment settles.
Open your report
The check runs live on your site in under a minute: a grade, a score out of 100, and every finding in the order to fix it.
Fix it, then re-check
Forward the report to whoever runs your website. When they are done, press Re-check: the report shows exactly what moved from Fix to Pass.
A fix list, not a scare report
- A grade and a score out of 100. Any critical finding caps the grade at F, so a good score can’t hide an open door.
- Every finding, in the order to fix it. What we saw, why it matters in plain words, and how to fix it.
- The exact change, ready to paste. For Apache/cPanel (.htaccess), Nginx and WordPress, plus the DNS records for your email, built from your own DNS — your existing senders kept.
- What we could not tell, said plainly. If a check can’t be answered from outside, the report says so instead of guessing — and those checks don’t count against your score.
- Re-checks that prove it. Run the check again after each round of fixes and see the before and after.
- English or Spanish, and printable. Switch language with one click, or save the report as a PDF for your web person.
One-time payment · No contract · No subscription
Pay in US dollars with PayPal, or in Chilean pesos with Flow (Webpay, cards). By ordering you confirm you own or manage the website you enter.
What the Security Check is not
It is an outside check: what anyone on the internet can see about your website and domain, without logging in. Nobody can honestly promise a site that can’t be hacked, and we don’t. A clean report means these specific doors are closed.
- Not a penetration test: we never try passwords, submit forms or exploit anything.
- Not a malware scan of your server: we only see what your site serves to the public.
- Not a compliance certificate: it doesn’t replace a PCI, ISO 27001 or SOC 2 audit.
Questions, answered
Is it safe to run on my website?
Yes. It makes the same plain requests a browser makes: your homepage, a few well-known file addresses that automated attack scripts already try on every site, and your public DNS records. It never logs in, never submits a form, never installs anything, and the load is a few dozen page views.
Do I need to know code?
No. Every finding says in plain words why it matters, and comes with the exact change ready to paste. Forward the report to whoever runs your website.
Which websites does it work on?
Any public website. WordPress sites get extra checks (outdated core, public login names, XML-RPC). The email checks work with any provider: Google Workspace, Microsoft 365, cPanel email and others.
Is this a subscription?
No. $49, once. Your report link keeps working, and it includes re-checks so you can prove each fix is live.
Can you make the fixes for me?
Yes, as a separate service. Reply to your receipt email or write to hello@netwebmedia.com and we will quote it for your site.
See what an attacker sees first
$49 once. Under a minute to run, a fix for every finding, and proof when it’s done.