How to Check Your Website's Security in 2026

Updated August 2026 · about a 9-minute read

Most website security problems are invisible until they cost you: a certificate quietly expires and browsers throw a full-page warning; a deploy drops a header and opens an XSS hole; someone spoofs your domain because it has no DMARC record. The good news is that the three things a security review checks first can all be verified from the outside, for free, in a couple of minutes.

This guide walks through the three layers that make up your external security posture — the part an attacker, a customer, or an auditor can see without any access to your servers — and shows you exactly how to check each one. It's the same model our free checker uses.

The three layers of external security posture

You don't need a penetration test to catch the most common, most embarrassing problems. Three checks cover the majority of what goes wrong:

1. Transport security (TLS/SSL) — is your certificate valid, trusted, and not about to expire? Are you using a modern protocol?
2. HTTP security headers — do your responses tell the browser to enforce HTTPS, block clickjacking, and stop cross-site scripting?
3. DNS & email authentication — can someone forge email from your domain? Is DNS configured to limit who can issue certificates for you?

1. Check your TLS/SSL certificate

The single most common outage in this category is a certificate that expired because nobody was watching the calendar. To check when yours expires from the command line:

echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null | openssl x509 -noout -dates

That prints the notBefore and notAfter dates. Beyond expiry, a complete check also confirms the certificate is issued to the right hostname, the chain is trusted, and the negotiated protocol is TLS 1.2 or higher. We cover the full method — browser, command line, and monitoring — in how to check SSL certificate expiration.

2. Check your HTTP security headers

Security headers are lines in your HTTP response that instruct the browser to behave more safely. They're free, they're a one-time configuration, and yet they're missing on most of the web — Content-Security-Policy is absent on roughly 82% of sites, Permissions-Policy on 78%, and HSTS on 45%. The headers worth having are HSTS, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy. Our security headers guide explains each one and how to add it on Nginx and Apache.

3. Check your DNS and email authentication

If your domain has no SPF and DMARC records, anyone can send email that appears to come from you — the engine behind most phishing and business-email-compromise fraud. As of May 2026 the DMARC standard was rewritten as DMARCbis, and Gmail and Yahoo now permanently reject bulk mail that fails authentication. If you send any email at all, this is no longer optional. See how to stop email spoofing with SPF, DKIM and DMARC.

A snapshot is not protection

Here's the trap: you run the checks today, everything's green, you move on. Then three months from now a certificate renews wrong, a developer ships a config that drops your CSP, or a DNS edit breaks SPF — and you don't find out until a customer or an auditor does. The checks above are a photograph; security is a movie. That's the case for continuous monitoring, and for regulated teams, for turning these checks into audit evidence.