Free · 8 checks
Email Spoofing Checker
Can someone send email pretending to be you? Check your domain's SPF, DKIM and DMARC records, with a plain-English verdict, a score out of 100 and a fix for every gap.
Free tools · Website security
Free website security checks.
Six automated checks for the risks that come with owning a domain, sending email, shipping code to browsers, your team using AI tools and AI agents reading your site. They take seconds, run in your browser and show you what to fix.
Six tools
Pick a check.
Each one answers a single question in plain English, with a score and a fix for every gap it finds.
Free · 40+ key types
API Key Leak Checker
Is your website leaking API keys? Scan your HTML and JavaScript for secret keys, tokens and passwords any visitor could copy, and see which keys are meant to be public.
Free · 8 checks
Domain Hijack Checker
Could someone hijack your domain? Check its registrar locks, renewal date, DNSSEC, CAA record and forgotten subdomains, with a score out of 100 and a fix for every gap.
Free · 12 questions
Staff AI Risk Scorecard
Are your staff using AI safely? Score how your team uses ChatGPT, Copilot and other AI tools, get a prioritised fix list and a free AI use policy template.
Free · RFC 9116
security.txt Generator
Tell people who find a security flaw on your site how to report it. Create a security.txt file, check your existing one and get a disclosure policy template.
Free · 10 checks
AI Prompt Injection Scanner
Is your website hiding instructions for AI? Paste a page's HTML to find invisible text, comments, attributes, schema and Unicode tricks aimed at ChatGPT, Claude and AI agents.
Which check should I run first?
Start with the Email Spoofing Checker. It takes about five seconds, and its most common fix stops fake emails in your name reaching your customers.
| Tool | Answers | Protects against | Takes |
|---|---|---|---|
| Email Spoofing Checker | Can someone send email pretending to be you? | Fake invoices and phishing emails sent in your name | About 5 seconds |
| API Key Leak Checker | Is your website leaking secret keys? | Bills, data breaches and account takeovers from keys in your site's code | Under a minute |
| Domain Hijack Checker | Could someone take control of your domain? | Losing your website and email to a hijacked or lapsed domain | About 5 seconds |
| Staff AI Risk Scorecard | Are your staff using AI safely? | Client and personal data ending up in AI tools nobody approved | About 3 minutes |
| security.txt Generator | Do people know how to report a flaw on your site? | Security problems reported to the wrong place, or not at all | About 2 minutes |
| AI Prompt Injection Scanner | Is a page hiding instructions for AI? | Hidden text that steers ChatGPT, Claude and AI agents | Seconds per page |
Why these risks catch businesses out
- 43% of UK businesses reported a cyber breach or attack in the last 12 months, according to the government's Cyber Security Breaches Survey 2025/26.
- Phishing was the most common type, experienced by 38% of businesses.
Most of these attacks don't need anything sophisticated. A domain without a DMARC policy can be used to send fake invoices. A registrar account without transfer locks, or a domain left to expire, can be taken over. A forgotten subdomain can be pointed at someone else's content. Each of these shows up in public records, which is what our checks read.
What these checks can and can't do
- They read public data only: DNS records, the domain's registration record and code you choose to paste. They never scan, log in to or send anything to your server.
- Nothing reaches us unless you ask for a review of your result.
- They can't see inside your systems. Passwords, software updates, backups and who has access all matter, and none of them show up in public records.
For those basics, the government's Cyber Essentials scheme sets the minimum standard it recommends for organisations of all sizes. For anything you're unsure about, speak to your web developer, hosting provider or a qualified security firm.
Frequently asked questions
Are these security checks free?
Yes. All of them are free, with no sign-up and no limit on how many times you run them.
Do the tools scan or attack my website?
No. The domain and email checks read public records that any mail server or browser can see: DNS and the domain's registration record. The prompt injection scanner and the API key checker only read code you paste or upload. Nothing probes your server.
Which check should I run first?
The Email Spoofing Checker. It takes about five seconds, and the most common fix, a DMARC policy, protects your customers and suppliers from fake emails in your name as well as protecting you.
How often should I run them?
Whenever you change email provider, registrar or DNS host, or start using a new service that sends email for you. Otherwise every few months, and before your domain is due to renew.
Can I check someone else's domain?
Yes. The records are public, so you can check a supplier or client's domain too. It's a useful sign of how seriously they've set up their email, though it can't tell you whether a particular email is real.
Do you offer security services?
No. GMK Digital is a digital agency, not a security firm. These are free automated checks that show you what to look at. If one finds something you don't recognise, speak to your web developer or hosting provider.
These are automated checks of public information, not a security audit. GMK Digital is a digital agency and doesn't sell security services.