See what bots already know about your site.
We read what your site answers in public: certificate, exposed files, security headers, cookies, email records. Then you get one verdict and a numbered list of what to fix first.
What the check looks at
34 checks in nine groups. All of them are things a stranger can learn from outside — which is exactly why they matter: bots learn them first.
Exposed files
.env, .git, database dumps, site archives, logs, phpinfo. Usually one download away, and the download holds the passwords.
Certificate and HTTPS
Expiry, issuer, chain, and whether the first request can still travel in plain text without HSTS.
Security headers
HSTS, CSP, X-Frame-Options, nosniff, Referrer-Policy, Permissions-Policy — what tells the browser how to behave.
Cookies
HttpOnly, Secure and SameSite on session cookies. Missing flags turn one bug into a stolen login.
Server and platform
PHP branch and whether it still gets patches, server version tokens, CMS version exposure.
Domain and email
SPF, DMARC, MX, CAA, nameservers — whether someone can send mail as your domain.
How to read the result
There is no score out of 100. A number invites arguing; a named file does not. You get three things:
| What you see | What it means | What to do |
|---|---|---|
| Critical | Something is readable or forgeable right now — a public .env, an expired certificate, a downloadable dump. | Fix today. Each card names the file or header and the consequence. |
| Needs work | Nothing is exposed, but the site is missing defences that cost trust and traffic over months. | Fix this week. Start with number 1 in the list. |
| Clear | Every passive check came back clean at the time of the scan. | Nothing to do. Re-check after changes or monthly. |
This is a passive check: public responses only. It cannot see what sits behind a login, inside the database, or in server logs — no passive method can. What it can do is show the part of your site that is already visible to everyone else.
Check the site you are already on
The browser extension shows the same verdict without leaving the tab: one click on the icon, and you see criticals and the top three fixes. It also adds “Checklamp: check this site” to the right-click menu and to any selected domain.
Install: unpack the ZIP, open chrome://extensions, turn on Developer mode, click “Load unpacked” and pick the folder. Not in the Chrome Web Store yet — the unpacked build is the same code.
Questions
Do you break into my site?
No. We send ordinary public requests — the same ones a crawler or a browser makes — and read the answers. No port scanning, no password attempts, nothing written to your server.
Do I need to install anything or give server access?
Neither. The check runs from outside, which is also its limit: findings that require a login or a server shell are out of scope for this report.
Is the result really free?
Yes — the full report, every finding and every fix. Later there will be paid extras around it (monitoring, a branded PDF for clients), never a paywall in front of the result.
I'm not a developer. What do I do with this?
Send the report to whoever maintains the site. Each finding says what is visible, why it matters, and the exact change to make — in plain words, no exploit details needed.
Can I check a site that isn't mine?
The check is passive, but use it on sites you are responsible for or have permission to review. Don't use it to build lists of other people's weak sites.
Why does it sometimes find nothing?
Because a well-maintained site hides its files, sends the right headers and renews its certificate. A clean report means: nothing that this method can see was open at that moment.