See what attackers can see on your website. Then fix it.
CLIC404 checks your site from the outside — HTTPS, security headers, exposed files, and whether anyone can send email pretending to be you — and tells you in plain English how to fix each issue.
Anyone can send email as you
No DMARC record. Fake invoices "from" your domain can reach your customers, and Gmail may send your real email to spam.
Fix: _dmarc TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@example-dental.com"http:// does not redirect to https://
Visitors who type your address without https can be intercepted on public Wi-Fi.
Fix: Redirect 301 to https and add: Strict-Transport-Security: max-age=31536000No Content-Security-Policy
The browser has no rules about which scripts your site may run.
Fix: Content-Security-Policy: default-src 'self'Server version is visible
Bots use version numbers to pick targets.
Fix: ServerTokens Prod (Apache) · server_tokens off; (nginx)Websites checked with CLIC404, by where they are hosted
Each orange dot is a country where the server of a checked site is located. The count only grows: every check adds one. We only publish the country and the count — never the site, the email or the IP.
21 checks run
Check your SSL certificate instantly
Free and no signup: type your domain and see in seconds whether the certificate is valid, who issued it and when it expires.
Is this email real? Find out before you click
Swapping one letter for its twin from another alphabet is all it takes for a fake email to pass as a well-known company. Paste the sender and we show you what the eye cannot see.
- Letters faked with other alphabets, invisible characters and domains disguised as well-known brands.
- Whether the domain exists, can send email and publishes SPF, DKIM and DMARC.
- When the domain was created: most scams use domains that are only days old.
Three gaps that leave small-business sites exposed
Email that can be spoofed
Without SPF, DKIM and DMARC, scammers can send messages that look like they came from you. Gmail and Yahoo now expect these records from bulk senders, so missing them also hurts your real email.
Missing security headers
A few lines of server configuration tell browsers to block clickjacking, mixed content and injected scripts. Most sites never add them.
Exposed files and visible software
Leftover backups, .env files, .git folders and version banners are the first things automated bots look for.
Check, fix, keep watching
Check
Enter your domain. In a few minutes you get a report by email with a score, a risk level and every finding explained.
Fix
Each finding comes with the exact setting or code to change. Do it yourself, hand it to your web developer, or have us do it.
Watch
On a monitoring plan we repeat the checks every 24, 12 or 1 hours and email you when something new appears or your site goes down.
Start free. Pay only for what you need.
Prices in US dollars. Monthly plans cancel anytime.
- 1 verified site
- Security check every 24 h
- Email alerts for new findings
- Downtime every 5 min and SSL expiry
- History and PDF reports
- Up to 3 verified sites
- Security check every 12 h
- Alerts, history and PDF reports
- Resolution metrics (MTTR)
- API to integrate the scanner
- Up to 10 verified sites
- Hourly security check
- Monthly executive report (MITRE ATT&CK + ISO 27001)
- MTTD and MTTR per site
- API and priority support
We fix it for you
We apply the fixes from your report on your server, DNS and email: HTTPS and HSTS, security headers, SPF/DKIM/DMARC, hidden server versions and closed exposed files.
- Scope and fixed price agreed before you pay
- Done within 5 business days of getting access
- Re-check included to confirm every fix
Multi-page audit with a written plan
Passive checks on up to 25 pages of your site, every finding prioritized, and an executive plus technical report with a step-by-step remediation plan.
See what is includedBuilt for teams without a security department
Small businesses
Clinics, law and accounting firms, home services, shops — anyone with a website and email on their own domain.
Agencies & freelancers
Check every client site before handover and keep watching them. The Business plan covers up to 10 sites with a monthly executive report.
Online stores
Checkout pages and customer email are the first targets. Know when a certificate is about to expire or a header goes missing.
What we don't do — and we tell you upfront
- We only look at what is public, from the outside. We never exploit anything or submit your forms.
- This is not a penetration test, and we don't install agents or read your logs.
- If we find nothing, we say "no findings in the passive surface checked" — never "your site is secure".
Frequently asked
Is it legal to check a site like this?
Yes. We only read what any browser or mail server can already see: your certificate, headers, public DNS records and whether common files are exposed. No attack, no login attempts.
Do I need to install anything?
No. Just type your domain. Monitoring plans ask you to verify ownership with a DNS record or a small file.
What happens if you find a problem?
Every finding comes with the exact fix. If you prefer not to touch your server or DNS, ask for a quote and we do it for you.
How do I pay?
Payments are processed by PayPal. You get a receipt by email, and monthly plans can be cancelled anytime from your dashboard.
Can I talk to a person?
Yes. Use the contact form and a member of the team replies by email, usually within one business day.
Find out what your website is showing the world.
Run my free checkAlso from CLIC404: ready-to-install n8n automation templates · Browse templates