Tool · Cyber security
External Security Check.
Find out what anyone on the internet can learn about your security, explained like a security consultant would. We check eight areas, rank what we find by real risk, and map every finding to OWASP, CIS Controls and NIST CSF.
Who gets the full report
A detailed list of weaknesses for someone else's website would help attackers. So:
- Email at the scanned domain (for example [email protected] checking charity.org): the full technical report, with exact versions, records and evidence.
- Any other email: a summary report with the score, areas and general fixes, but no exploitable details.
No AI. No form submissions, logins or attack tests.
How this check works
- Passive only. We read public DNS, public certificate logs and the pages any visitor receives. We never submit forms, log in, probe hidden paths, scan ports or test for weaknesses.
- Full report only for your own domain. If your email is at the scanned domain you get the full technical report. Any other email gets a summary without exploitable details, because a list of someone else's weaknesses would help attackers.
- No AI. Every finding uses fixed, reviewed explanations: what it means, why it matters and how to fix it.
- Methodology. See exactly what we check, the data sources and how the score works on the methodology page.
Want help fixing what we found?
OST can fix email authentication, security headers and outdated software, and review what your donation and form pages share with other companies.