Website security.
Clear next steps.
Check public website and email settings, understand the evidence and plan the next action. Practical guidance for UK businesses and the people who support them.
Continues to the private workspace. Authorised access and domain verification required.
v=DMARC1; p=noneA monitoring-only DMARC policy needs a considered next step.
Check legitimate senders and alignment before planning a staged enforcement rollout.
Suggested owner · Email administratorSynthetic examples. No scan of example.com was performed.
A useful first step, whatever your setup.
I want to check my website
Open the protected workspace for a verified-domain check of public web and email settings.
Get startedI already use a scanner
Use an authorised workspace connection to HostedScan or Pentest-Tools.com.
Get startedI need a practical plan
Answer ten questions and get a tailored plan for your security arrangements.
Get startedFrom uncertainty
to a clear course of action.
Keep the observation, the limitation and the next step together. Your team gets a useful starting point for fixing and verifying what matters.
See what was observed
Separate observed passes, findings that need attention and checks that could not be verified.
Give the work a direction
Read the recommended action, identify the right provider and copy a clear handoff with evidence.
Review the next assessment
Compare suitable reports, keep unknowns visible and use new evidence to assess the outcome.
Know what the check
can tell you.
Security starts with an honest picture. Each report explains which observations were made and where more evidence is needed.
See all assessment requirementsPublic check coverage
- Public DNS and hostname resolution
- HTTPS, redirects and selected security headers
- SPF, DMARC and optional DKIM observations
- Dated evidence and a practical next action
Internal systems, account security, backups, malware and application behaviour behind a login are outside this public check. Use the guided review to plan the evidence you need.
Explore the guided reviewUnderstand the development.
Know what to do with it.
PHP alert: ask your hosting provider for patch evidence
The NCSC’s 21 October alert makes a timely case for checking the software behind your website, including components managed by your host.
NCSC resilience guidance: start with your critical services
Apply the NCSC’s October guidance by connecting technical findings to the services your business needs to keep running.
Passkeys: protect the accounts behind your website
A September update to UK business guidance added passkey advice. Your registrar, hosting and email accounts are a good place to apply it.
Learn it.
Put it into practice.
Follow a learning path, save a useful guide and work through a checklist. Find the explanation you need at the moment you need it.
Explore the knowledge hubExplore the topics: Website security · Email security · Vulnerability management · Business resilience.
A few useful answers.
Get clear on the checks, the evidence and your data.
All help & common questionsCan I check a website without an API key?
The public-baseline mode in the protected workspace needs no scanner API key or scanner subscription. Existing authorised access is required. Sign in, confirm that you have permission and verify control of the hostname with a DNS TXT record or HTTPS file. You can explore the sample report and the guided security review without connecting a scanner.
Start a public checkWhy are some findings marked not verified?
A request may be blocked, a DNS lookup may fail or the evidence may be outside the scan's scope. CyberScan keeps these gaps visible. Not verified means more evidence is needed; it does not mean either safe or vulnerable. Read the finding's evidence and next step before deciding what to change.
Explore the sample reportWhere does my scanner API key go?
The key is held in the current workspace page's memory and sent over HTTPS to the protected workspace's server for the requested operation, then to the selected provider's fixed API endpoint. The application does not persist it in its database, reports or browser storage. Disconnect or leave the workspace to clear the current connection.
Read the data-handling detailsYour next step starts here.
Check your website, connect your scanner or build a practical plan.