Website Security Inspection · Compliance · Performance · Email Authentication
Security scanners give you data. WebInspect gives you answers.
Scan your website for SSL/TLS vulnerabilities, HTTP security headers, DNS configuration, SPF, DKIM, DMARC, cookie security, CORS misconfigurations, and potential information or infrastructure exposure. Get clear, prioritized findings with actionable recommendations and relevant OWASP Top 10 and PCI DSS context.
Tool Advisor
Describe what you are trying to fix and our advisor will point you to the right tool.
NEWPost-Quantum TLS
Test whether your domain supports ML-KEM hybrid key exchange and Encrypted Client Hello.
POPULAREmail Security Check
Analyse SPF, DMARC and DKIM. Counts SPF lookups recursively against the RFC 10-lookup limit.
Live
Domains inspected today, ranked by security score.
Only websites scoring 75+ make it to the board. Will yours? Check yours now for free →
Plans
Start with a free inspection, upgrade to any tier from your results.
Know where your site stands in 60 seconds. An instant security snapshot of your domain (no signup required).
Hand your developer a prioritized fix list, not a raw scan. Expert explanations and practical guidance for developers and technical teams.
Includes everything in the Basic inspection. Available from your results page.
The exact lines to paste, matched to your provider and your stack. You don't need to work out what to change, just where to paste it.
Includes everything in the Technical Report. Available from your results page.
A security consultant reads your results and tells you what actually matters. Manual validation, adjusted priorities and a tailored action plan, signed by the consultant who wrote it.
| Basic Free | Technical €15 | Guided €35 | Expert Review €100 | |
|---|---|---|---|---|
| Technical findings | ✓ | ✓ | ✓ | ✓ |
| Security & Compliance Readiness | ✓ | ✓ | ✓ | ✓ |
| Risk explanations | — | ✓ | ✓ | ✓ |
| PCI DSS & OWASP relevance | — | ✓ | ✓ | ✓ |
| Step-by-step fix instructions | — | — | ✓ | ✓ |
| Copy-paste config examples (Apache, IIS, NGINX, HAProxy) | — | — | ✓ | ✓ |
| Personalized expert review | — | — | — | ✓ |
| Human consultant | — | — | — | ✓ |
You can upgrade to a higher plan at any time by paying only the difference.
Real report excerpt
Inspected domain: webinspect.pro
Cross-Origin-Resource-Policy (CORP) not set
CORP tells browsers which origins may load this resource. Without it, any origin can embed or fetch the response. On pages that return user-specific content,…
📋 OWASP HTTP Security Response Headers Cheat Sheet — OWASP ASVS V14.4
Cross-Origin-Embedder-Policy (COEP) not set
COEP controls whether the page may load cross-origin resources that have not explicitly granted permission via CORS or CORP. Together with COOP it enables cr…
📋 OWASP HTTP Security Response Headers Cheat Sheet — OWASP ASVS V14.4
No DMARC record found
Without DMARC, even with SPF and DKIM in place, there is no policy telling receiving servers what to do with failed messages. Attackers can freely spoof your…
📋 RFC 7489
Inspected domain: webinspect.pro
DNS & Email Security
DNS record changes are made as TXT records in your DNS provider's control panel.
SPF (Sender Policy Framework)
SPF is configured with a hard fail (-all) policy. ✓
DKIM (DomainKeys Identified Mail)
DKIM adds a cryptographic signature to every email your domain sends. Receiving servers use it to verify the email was genuinely sent from your domain and was not modified in transit. Without it, your emails are more likely to land in spam.
💡 Enable DKIM signing through your email provider. They will supply either a TXT or CNAME record that must be added to your DNS in your DNS provider's control panel.
DMARC (Domain-based Message Authentication)
DMARC helps protect your domain against email spoofing and phishing by telling receiving mail servers how to handle messages that fail SPF or DKIM validation.
Before You Begin
Add this TXT record at _dmarc.webinspect.pro to start monitoring:
Step 1 — Monitoring policy (Name: _dmarc)
v=DMARC1; p=none; rua=mailto:[email protected]; fo=1
💡 The p=none policy does not affect email delivery. Instead, it collects DMARC reports from participating email providers so you can verify that all legitimate email services sending on behalf of your domain are authenticating correctly.
Get step-by-step guidance for every finding.
Ready-to-use config examples for Apache, NGINX and IIS — matched to your server
Your report will reflect your own domain. Technologies detected, DNS provider identified, instructions tailored to your setup.
Security Checks
Learn what WebInspect checks when it inspects your website, from SSL/TLS and security headers to DMARC, DNS and PCI DSS readiness indicators, and why each area matters.
WebInspect Partner Program
We're expanding our network of trusted security professionals around the world. If you're a cybersecurity professional or company interested in delivering Expert Reviews to clients in your region, we'd like to hear from you.