# Website security check in 15 minutes > Four free public checking tools, what their grades mean for a manager, and how AI turns them into a clear one-page report with tasks for your website developer in 15 minutes. ## Why this is the manager's business, not just the developer's The website was often built a few years ago, the agency that built it now works with others, and the logins are “somewhere”. Yet three things depend on it, and the manager is responsible for all three: - **Clients' trust.** A hacked website can spread scam pages, and Google then shows a red warning instead of your company. - **Email.** The same domain is also your email address. If it isn't protected, Sigitas the scammer (our recurring villain — Sigitas is a common Lithuanian first name) can write to your clients “as you” — as in the lesson [Invoice fraud](/en/lessons/invoice-fraud). - **The domain itself.** A forgotten renewal means that the next day your website and email may be gone. The good news: you can check all of it in 15 minutes with free public tools. ## The most important rule: you only check your own All the tools in this lesson only **look** at what the website shows everyone. They don't break into anything. But deeper scanning without the owner's permission may be illegal. So we check **only our own website** — or one whose owner has given permission. We write this rule into the AI prompt too. ## Four tools, four questions 1. **[SSL Labs](https://www.ssllabs.com/ssltest/)** — is HTTPS set up properly, and when does the certificate expire? The goal is a grade of A or better. 2. **[Mozilla Observatory](https://developer.mozilla.org/en-US/observatory)** — does the website send the browser security instructions (security headers)? 3. **[internet.nl](https://internet.nl/)** — the website and email in one go: is the domain protected against spoofing (SPF, DKIM, DMARC)? 4. **[Google Safe Browsing](https://transparencyreport.google.com/safe-browsing/search)** — does Google consider your website dangerous? On top of that, two questions that you answer, not a tool: **who has access to the website** and **when the domain registration expires**. ## What the result looks like Here's an example of the report you should get after the check: > **Schema.** An example website check report: HTTPS and the certificate are fine and Google Safe Browsing is clean, but security headers are missing, the website's content management system is outdated, the email domain isn't protected by a DMARC record, and domain auto-renewal isn't switched on. ## The 15-minute check — done by AI If your AI can control a browser, it will open all four tools itself, enter your domain and collect the results. If it can't, it will tell you where to click, and you'll paste the results in. Copy and paste: ```text You are my IT security adviser. Check my company website's security with public tools and prepare a report that someone outside IT would understand. ABOUT US - Website: [yourcompany.lt] - Who built and maintains it: [agency / employee / don't know] - Where it's hosted, if you know: [...] PROCESS 0. TOOLS. Tell me whether you can control a browser yourself. If not, give me the links and tell me what to paste back to you. 1. CHECK. SSL Labs, Mozilla Observatory, internet.nl (website and email), Google Safe Browsing. Only my domain. 2. ASK. Ask me who has access to the website and whether domain auto-renewal is switched on. 3. REPORT. As a table: what was checked → result → what it means in plain words → who should fix it. Rank the problems by risk. 4. TASKS. For each problem, write a short, precise message I can forward to the website developer or the hosting company. GOAL The job is finished when I have a one-page report and ready-made messages for each person responsible. RULES - Check only the domain I gave you. No deeper scanning. - Change nothing: not on the website, not in DNS, not in hosting. - Never ask for passwords or access to the admin panel. - Don't make up results. If a tool didn't respond, say so. - Answer in English. AT THE END Separately — WHAT YOU DID NOT CHECK (e.g. admin accounts, backups, the inside of plugins), and what to ask the website developer. ```

🤖 AI route recommended

The AI checks, you decide

An AI that controls a browser will run all four checks itself and return a report with ready-made messages. An ordinary AI chat will ask you to paste the results in — still faster than working out each grade yourself.

Your job: answer two questions about access and the domain, and forward the messages to the people responsible.

✋ Manual route

Four tabs

  1. Open the four tools above and enter your domain in each.
  2. Write down the grades and the items marked in red.
  3. Send the screenshots to your website developer with the question “which of these will you fix, and by when?”.
## Email protection: three records that are most often missing This point matters most, because scammers exploit it directly. The domain's DNS settings must contain three records: - **SPF** — a list of the servers allowed to send in your domain's name. - **DKIM** — an electronic signature on every email you send. - **DMARC** — an instruction to recipients on what to do with an email that pretends to be you. DMARC is brought in gradually: at first in monitoring mode only, so that your genuine emails (e.g. from your invoicing software) aren't stopped, and only then is it tightened. That's a job for an IT person or your email provider — but you can check yourself, in a minute, whether it's been done. ## What to do today 1. Copy the prompt and get your report in 15 minutes. 2. Check the domain's expiry date and switch on auto-renewal. 3. Forward the ready-made messages to the people responsible, and put the next check in the calendar for three months from now. Need help? **pagalba@itbroliai.lt** ## Check yourself Five questions on what you've just read. At the end you'll get a certificate with your score.