Is Your Website as Safe as You Think? Check It Free

Most business owners can tell you whether their website looks right. Far fewer can tell you whether their SSL certificate renews on its own, whether Google is allowed to index the homepage, or whether a scammer could send an email that appears to come from their domain tonight.

That isn't a knock on anyone. These things are invisible until they break, and when they break, they usually break quietly. A certificate lapses and visitors get a big red "Not secure" warning. A leftover "noindex" tag from a site rebuild keeps you out of Google for months. A missing email record lets someone send fake invoices in your name.

So I built a tool that checks all of it in a few seconds, for free.

Check your website free →

What It Checks

Enter your website address and you get a plain-English report covering five areas. Every item is marked as passed, a warning, or failed, and the whole site gets an overall grade from A to F.

SSL & HTTPS. Is your security certificate valid and trusted? How many days until it expires? And when someone types http:// instead of https://, are they sent to the secure version or left on the insecure one?

Security headers. These are instructions your site gives the browser to protect your visitors. They cover things like refusing to load in a hidden frame on someone else's site (a trick called clickjacking) and only allowing approved scripts to run. We also check whether your server advertises its exact software versions, which saves an attacker a step when looking for known vulnerabilities.

SEO basics. Can search engines index your homepage? Does it have a title tag and meta description of the right length, a single main heading, a canonical tag, and a mobile setup? Is there a robots.txt that isn't accidentally blocking Google, and a sitemap search engines can find? Do www. and the plain address end up at the same site?

Email security. This is the section that surprises people most. Three DNS records — SPF, DMARC, and DKIM — tell the world's mail servers which emails really came from you. Without them, anyone can send a message that looks like it came from your address, and your real emails are more likely to land in spam.

Domain health. When your domain expires, whether it's locked against unauthorized transfers, and whether your DNS runs on more than one server, so one outage doesn't take your site offline.

How It Works

1. Enter your web address. There's a box right on the Granite Cloud & Code homepage, or go straight to granitecloud.io/check. No signup, no email address required.

2. Watch the report fill in. Each section appears as it finishes, usually within a few seconds.

3. Read what matters. Every finding is explained in plain English, along with why it matters, not just a cryptic error code.

4. Fix it and check again. Every report has its own link you can save or send to whoever manages your site. Once something's fixed, click Re-check now to see the updated result.

One thing worth knowing: the check only reads what your website already shows the public — the same information any web browser or mail server sees when it visits. Nothing is scanned, probed, or changed. It's a health check, not a hacking attempt.

I Ran It on My Own Site First

The first real domain I pointed this at was granitecloud.io.

The site itself did well. The certificate, headers, and redirects were all in order. But the email section came back with two failures: no SPF record and no DMARC record. My email was working fine day to day, so I'd never had a reason to look. In practice, though, nothing was stopping someone from sending email that looked like it came from my domain.

Fixing it took about ten minutes: add two DNS records and turn on DKIM signing in Google Workspace. The site now grades an A. The SEO section also flagged one warning, a homepage title three characters longer than Google displays, which took thirty seconds to fix.

That's exactly the kind of thing this tool is for. None of these problems announce themselves. They just sit there until they cost you something.

What It Isn't

This is a quick check of the fundamentals, not a full audit. It looks at your homepage and your domain's public records. It doesn't crawl every page, research your keywords, judge your content, or analyze who links to you.

If you want that deeper look, that's what our full SEO audit is for: every ranking factor, checked by hand, with a prioritized fix list.

Found Something? Here's What to Do

Some fixes are a two-minute change in a settings screen. Others mean editing DNS records or server configuration, and that's where most business owners understandably get stuck.

If your report turns up something you'd rather not tackle yourself, get in touch and I'll take care of it wherever your site lives today. If your site is hosted on Granite Cloud, every item in this report is handled for you as part of hosting: certificates, security headers, email records, and domain renewals.

Run your free website check →