Website Security Grader: bulk SSL, security headers, SPF and DMARC check

Paste a list of websites and get an A–F security grade for each one, with every problem explained in plain language and a ready-to-apply fix. Built for agencies, MSPs, web developers and sales teams who need to audit many sites at once, not one by one.

All checks are passive: the Actor loads the public home page, reads response headers and public DNS records, exactly like a browser would. No port scanning, no vulnerability probing, no login attempts.

What it checks

Area	Checks
HTTPS	HTTPS available, HTTP → HTTPS redirect
TLS certificate	Valid and trusted, days to expiry, issuer, negotiated protocol (flags TLS 1.0/1.1)
Security headers	HSTS (and max-age), Content-Security-Policy, clickjacking protection (X-Frame-Options / frame-ancestors), X-Content-Type-Options, Referrer-Policy, Permissions-Policy
Information leaks	Server version, X-Powered-By, CMS version in meta generator
Cookies	Secure, HttpOnly and SameSite flags
Disclosure	security.txt (RFC 9116)
Email security	SPF record and +all/?all, DMARC record and policy (none / quarantine / reject)
Technology	WordPress, Shopify, Wix, Squarespace, Joomla, PrestaShop, Cloudflare

What can you use it for?

• Agencies and MSPs: audit every client site in one run and send each client a list of fixes.
• Lead generation: find prospects with an F grade, an expiring certificate or no DMARC, and offer to fix it.
• Monitoring: schedule it weekly and get alerted when a certificate is about to expire or a grade drops.
• Due diligence: quick security hygiene snapshot of a supplier or acquisition target.

Example output

{
  "domain": "example.com",
  "grade": "D",
  "score": 42,
  "summary": "example.com: grade D (42/100), 1 high, 3 medium, 2 low",
  "https": true,
  "httpToHttpsRedirect": false,
  "tls": {"valid": true, "protocol": "TLSv1.3", "expiresAt": "2027-01-15", "daysToExpiry": 75},
  "email": {"domain": "example.com", "spf": "v=spf1 -all", "dmarc": "v=DMARC1;p=reject", "dmarcPolicy": "reject"},
  "issues": [
    {"id": "no_redirect", "severity": "high", "issue": "HTTP does not redirect to HTTPS", "fix": "Redirect all http:// requests to https:// with a 301."},
    {"id": "no_hsts", "severity": "medium", "issue": "Missing Strict-Transport-Security (HSTS)", "fix": "Add: Strict-Transport-Security: max-age=31536000; includeSubDomains"}
  ]
}

The dataset has two views: Grades (one row per site) and Issues and fixes (one row per issue), both exportable to CSV, Excel or JSON.

How the grade works

Every site starts at 100. Each issue subtracts points by severity: critical −40, high −20, medium −10, low −4, info 0. Grades: A 90+, B 75+, C 60+, D 40+, E 20+, F below 20. Sites with an invalid or expired certificate are still analysed. Sites that cannot be reached at all get grade N/A and the connection error.

Input

Field	Description
Websites or domains	One per line: example.com, https://shop.example.com
Report language	English or Spanish (Español)
Check email security	SPF and DMARC lookups (on by default)
Max concurrency	Sites checked in parallel (default 10)
Max domains	Safety cap per run

Pricing

Pay per result: you are charged for each website in the results, including sites reported as unreachable.

Español

Analiza en bloque la seguridad de muchas webs y obtén una nota de la A a la F con cada problema explicado y su solución en español (elige Español en Report language). Revisa HTTPS, certificado, cabeceras de seguridad, cookies, security.txt, SPF y DMARC. Solo comprobaciones pasivas.

Notes

Only use it on websites you own, manage or have a legitimate reason to review. Results reflect the public home page at the time of the check; a high grade does not guarantee a site is secure.