Website Security Check for Indian Businesses

What you get

Free preview

An overall grade
Total findings and how many are critical, high, medium, low or informational
The three most serious findings, with a short explanation

Full report, on request by quotation

Every finding, with the evidence we saw
OWASP and CWE references where relevant
Step-by-step fixes your developer can follow

The check only reads what your website already shows every visitor. It does not log in, guess passwords or try to break anything. To get the full report, use the button on your result page: we send you a quotation first, and no payment is taken on this website.

A website security check for Indian businesses

Most small business websites in India are set up once and then left alone. Nobody looks at the security headers, the age of the TLS certificate, or whether an old admin page is still reachable. The Website Security Check looks at the parts of your site that anyone on the internet can already see. You get a free preview straight away: an overall grade, how many issues were found by severity, and the three most serious ones. The full report, with every finding and the steps to fix it, is a paid service that we provide on request, by quotation.

What this check is, and what it is not

It is an automated, passive security assessment. It reads what your website publicly sends to any visitor and compares it with widely used good practice. It is advisory only.

It is not a VAPT (vulnerability assessment and penetration test).
It is not a certified security audit, and it does not give you a certificate, a compliance statement or any approval from a regulator or the government.
If you need an audit for compliance, for example because a regulator, a bank or a customer contract asks for one, use a CERT-In empanelled auditor. This check does not replace that audit.
It does not try to break in, guess passwords, log in, or submit forms on your site.
It cannot find every problem. A good grade means the checks we ran found little to report, not that your site is safe.

What kind of issues it looks for

The checks are about how your site is configured and what it exposes publicly. Typical examples are:

HTTPS and certificate setup, and whether visitors are redirected from plain HTTP.
Missing or weak browser security headers, such as Content-Security-Policy, Strict-Transport-Security and X-Frame-Options.
Cookies that are missing the Secure, HttpOnly or SameSite flags.
Email security records for your domain, such as SPF and DMARC.
Information the server gives away that attackers like to see, such as detailed version banners or outdated script libraries.
Sensitive-looking files or pages that appear to be publicly reachable.

Where it helps, each issue in the full report is mapped to a reference from the OWASP Top 10 or the CWE list, so your developer can look it up.

How it works, step by step

Enter your website address and your email address.
Confirm that you own the website, or have the written permission of its owner, and accept the terms.
Answer the small maths question, then enter the 6-digit code we email you. This proves the email is yours and keeps automated misuse down.
The check runs on our servers and usually finishes within a few minutes. The result page refreshes by itself.
You see the free preview: your grade, the number of findings by severity, and the top three findings with a short explanation.
If you want the rest, press "Get the full report" on your result page and tell us how to reach you. We send you a quotation; once you accept it, we prepare the full report for your site and send it to you.

Worked example: a small business website

Suppose a small trading company enters example-traders.in. A few minutes later the result shows grade C, with 7 findings: 0 critical, 1 high, 2 medium, 3 low and 1 informational. The free preview lists the three most serious ones, for example "Site does not send a Strict-Transport-Security header" and "Session cookie is missing the Secure flag", each with a one-line explanation of why it matters. The remaining four findings, and the step-by-step instructions to fix all seven, are in the full report. (This example is illustrative. Your result depends entirely on your own site.)

Free preview and the full report

The free preview is meant to show you honestly where you stand. It does not include the evidence we collected or the fix instructions. The full report lists every finding with the evidence, the OWASP and CWE reference and clear, step-by-step remediation your developer can follow. It is a paid service, prepared on request and quoted for your site: you see the quotation before any work starts, and you decide whether to go ahead. No payment is taken on this website.

Your data

We keep the website address, your email address, your IP address, the time of the request and the result for 180 days, to prevent misuse and to be able to follow up on your request. Details are in our Privacy Policy and Terms and Conditions.

Who should use it

Owners of business websites, online shops and portals who want a first look at their security posture before talking to a developer; agencies who want a quick check on a client site they are allowed to test; and anyone who has just moved to a new host and wants to confirm the basics. Only test websites you own or are explicitly allowed to test. If you want help acting on the findings, see our other services or get in touch.

Frequently asked questions

What is free, and what is paid?

The preview is free: an overall grade, the number of findings by severity and the three most serious findings with a short explanation. The full report, with every finding, the evidence and step-by-step fixes, is a paid service. Ask for it from your result page and we send you a quotation first. Nothing is charged on this website.

Is this a VAPT or a certified security audit?

No. It is an automated, passive and advisory assessment. It does not try to break into your website, and it gives no certificate, compliance statement or government or regulatory approval. If you need an audit for compliance, use a CERT-In empanelled auditor.

Which websites can I check?

Only a website you own, or one where the owner has given you written permission. You confirm this before the check runs and you remain responsible for that declaration. Checks of addresses that are not allowed are refused.

Why do I need to verify my email?

The 6-digit code proves that the email address is yours. It limits automated misuse and lets you come back to your result later. We do not send marketing email because of it.

Will the check harm or slow down my website?

It is designed to be light. It sends a small number of ordinary requests, similar to a visitor opening a few pages. It does not log in, submit forms, guess passwords or try to exploit anything.

Does a good grade mean my website is secure?

No. A good grade means the checks we ran found little to report. No automated check finds every problem, and security also depends on things we cannot see, such as your server setup, passwords and the code behind your site.

What is in the full report, and how do I get it?

Every finding with its severity, a plain-language explanation, the evidence we saw, an OWASP or CWE reference where relevant and step-by-step instructions to fix it. Press "Get the full report" on your result page and tell us how to reach you. We reply with a quotation, and prepare the report once you accept it.

How long do you keep my data?

The website address, your email, IP address, the time of the request and the result are kept for 180 days to prevent misuse and to serve your request, then deleted. See the Privacy Policy for details.

Who is this service for?

Owners of business websites, online shops and portals in India, and the agencies and developers who look after them, who want a first look at their website's public security setup.