Free check · 22 passive tests · $5 full reportCan your email be spoofed? Does your site still take TLS 1.0?
The passive security scan that lands in your inbox from a stranger asking for a bounty, run for free, on demand, with nothing touched. Email authentication, TLS and certificate, HTTPS redirect, browser security headers and disclosure. Five seconds. The full report with the fixes is five dollars.
Passive and read-only: a few DNS lookups, four TLS handshakes, three page fetches. About five seconds. Nothing is stored beyond a ten-minute cache. 20 checks per hour per visitor.
What the grades mean
SPF lists your senders, DKIM signs your mail, DMARC tells receivers what to do when both fail. With p=none, spoofed invoices from your domain are still delivered.
HTTPS
A trusted certificate with weeks left, plain HTTP redirecting, TLS 1.0 and 1.1 refused. Old versions fail PCI DSS and let a downgraded client use weak ciphers.
Headers and disclosure
HSTS, CSP, clickjacking and nosniff tell browsers what not to do. security.txt tells people who find a problem where to send it.
FAQ
- What does it check?
- Twenty-two passive checks in four areas. Email: SPF present, single and strict, DMARC present, single, enforced and reporting, DKIM key, MX. HTTPS: available, old TLS refused, TLS 1.3, certificate trusted and valid 30+ days, HTTP redirects. Headers: HSTS, Content-Security-Policy, clickjacking, nosniff, Referrer-Policy. Disclosure: security.txt, server version hidden, CAA.
- Is it safe to run on my site?
- Yes. It is read-only and uses public information only: DNS records, four TLS handshakes, and three page fetches with a named user agent. No login, no forms, no load testing, no redirects followed off your host. Private addresses are refused.
- What is in the $5 report?
- Every finding with the evidence we saw, what it means in plain language, and the exact fix: the DNS record value, the nginx or Apache line, or the Cloudflare switch. A prioritised roadmap, the full table of all checks, and a print-to-PDF layout. Re-check free for 30 days while you fix things.
- Why is this free when others charge for it?
- Because the same scan is what unsolicited "security researcher" emails offer, followed by a request for a bounty or a review. We received one, verified every finding, and built the check so you do not have to answer those emails.
- Does a good grade mean my site is secure?
- No. It means your public posture is in order: your mail cannot be spoofed easily, visitors always get HTTPS, and browsers are told what not to do. The application itself, its logins, forms and data handling are not tested here.
- Can an agent use it?
- Yes. The free summary is at GET forgemesh.io/api/site-check?domain=example.com, 20 calls per hour per address. The full report as structured JSON is POST x402.forgemesh.io/site-security-report with {"domain":"example.com"}, $5 per call in USDC on Base over x402 or MPP, no account or key: every check with evidence, severity, fix and roadmap. An unpaid request returns the payment challenge.
For agents: the same report as JSON
POST x402.forgemesh.io/site-security-report with a domain, $5 per call in USDC on Base over x402 or MPP, no account or API key. Every check with evidence, severity, the fix and a roadmap, for audits and fleet sweeps.
Utility Grid routeRelated: post-quantum TLS readiness, how ForgeMesh handles security, wallet setup guide.