Looking for more in-depth information on this company—or any company worldwide? Visit companyforensics.org.
Free tool · Passive website security check
Enter your website address. We visit your public pages like a careful visitor would and check them for security problems: missing protections, unsafe scripts, hidden iframes, risky redirects, certificate issues and links to known malicious sites.
This usually takes 20–60 seconds.
Sample report: this is what a check of a site with many problems looks like. Run the tool on your own site to see your results.
Looking for more in-depth information on this company—or any company worldwide? Visit companyforensics.org.
Wordle Public Cybersecurity Assessment Unit
Building analytics graphs from the report and public DNS…
Wordle · Public security-check registry
Official register of the most recent company security checks published by Wordle — including every completed interactive check from this page, plus crawler reports.
Showing 24 of 58 published most recent automatic security checks · timestamps UTC.
Registry updated 2026-11-03T12:15:34Z
Passive scan plus web-check-style analytics graphs — still read-only, no attacks.
HTTPS, certificate validity and expiry, TLS version, and whether HTTP redirects to HTTPS.
HSTS, Content-Security-Policy, clickjacking protection, nosniff, Referrer- and Permissions-Policy, cookie flags.
Obfuscated or encoded JavaScript, crypto miners, card-skimmer patterns, hidden iframes, mixed content, missing Subresource Integrity.
Redirect chains, other domains your pages use, open threat-intelligence lists, and hashes of linked files scanned for malware.
DNS, DNSSEC, TXT/CAA/MX, WHOIS age, carbon estimate, trackers, CDN hints, archives and more with animated gauges.
No. We fetch at most 15 public pages, one at a time with a pause between requests, and stop at any path your robots.txt disallows. It is the same traffic as one visitor clicking through your site.
No. A penetration test actively tries to break in. This check is passive: it reads what your site already shows to everyone and flags known warning signs. For a full test, hire a qualified security firm.
Only with their permission. You must confirm you own the site or are allowed to check it before a scan starts.
Every completed interactive check is published to the Latest security checks registry above (and at /your-domain/), so the public ledger stays current. A short-lived in-memory copy also lets you view the live dossier. Download the JSON report if you want a personal copy.
Automated checks look for patterns, so some findings need a human look. Use the evidence shown with each issue to confirm it with your web developer.