--- title: Free Smart Website Checker description: Drop in any URL and get a complete picture of your website's health in seconds — is your domain about to expire, is HTTPS set up right, is your DNS in good shape, is your email protected from spoofing, is your address on a mail blacklist? One scan, one letter grade with the reasons behind it, no signup. canonical: https://watchfor.io/smart-website-audit --- [Back to all free tools](/free-tools) # Smart Website Checker Drop in any URL and get a complete picture of your website's health in seconds — is your domain about to expire, is HTTPS set up right, is your DNS in good shape, is your email protected from spoofing, is your address on a mail blacklist? One scan, one letter grade with the reasons behind it, no signup. Result No result yet Enter the inputs above and press Run. Results appear here in a moment. Monitor this 24/7 — get alerts on the first failure. [Start free](/auth/sign-up) Only run these tools against systems you own or are authorized to test. Using them to scan or probe systems without permission violates our [Terms](/legal/terms). ## What is Smart Website Checker ? A website audit checks the parts of your site that aren't visible in the browser but decide whether it stays online, trusted and deliverable — the TLS certificate and its expiry, the domain registration and its own expiry, the DNS records that route your traffic and your mail, whether email spoofing protection ( SPF , DMARC ) is in place, which HTTP protocols and security headers you serve. Any one of these can be quietly wrong on a site that looks perfectly fine, right up until the certificate lapses or the domain expires over a weekend. This tool runs all of those checks at once against a single URL and returns one scorecard: a letter grade plus a per-section breakdown (Domain, HTTPS, SSL/TLS, DNS, Email protection, Reputation, Reachability, Addresses & redirects, Protocols, Security headers, Performance, IPv6, CDN) with the exact findings that pushed each score up or down. The grade follows a [published rubric](/docs/reference/audit-grade) — what each section is worth, and what caps a grade no matter how the rest scores. No signup, no crawling your whole site — one scan of what actually matters for staying up and trusted. ## How it works One URL fans out into the same infrastructure checks a monitoring platform runs continuously — here, all at once: - 1 Resolve and connect — DNS is resolved and a real HTTPS connection is opened from a probe, negotiating TLS and the highest HTTP version the server offers ( HTTP/2 , HTTP/3 ) — the same handshake a browser performs. - 2 Inspect the certificate and domain — The live TLS certificate is read for its issuer, validity window and days-until-expiry; the domain registration is looked up over RDAP for its registrar and expiry date. These are the two clocks that take a site fully offline when they run out. - 3 Read the DNS and email posture — The record sets that matter are pulled — A / AAAA , MX , and the TXT records that carry SPF and DMARC . A domain that sends mail without an SPF and DMARC policy is a spoofing target; the audit flags it. - 4 Grade protocols, headers and speed — The response is examined for protocol support, the presence (or absence) of key security headers ( Strict-Transport-Security , Content-Security-Policy …), and a request-timing waterfall so a slow phase stands out. - 5 Check reputation, addresses and IPv6 — The address the site resolves to is checked against the mail blacklists that decide whether your invoices arrive; the apex and www hosts are compared to see whether one canonical address redirects to the other and whether plain http:// still serves the site; and an AAAA record is tested by actually connecting over IPv6, because publishing one that leads nowhere is worse than publishing none. Every finding rolls up into a per-section dot (good / warning / critical) and one letter grade — the headline in a second, the detail when you expand a section. The grade always shows what cost it points, and names anything it could not measure, so it can be argued with rather than taken on faith. ## When you'd use it ### You just launched or migrated a site A new deploy or a DNS migration is exactly when certificates, MX records and security headers get missed. One audit confirms HTTPS is set up right, mail still routes, and nothing regressed — before a user finds the broken part for you. ### Before the certificate or domain bites you Expired TLS certificates and lapsed domain registrations are the most common self-inflicted outages, and both are avoidable. The audit surfaces days-until-expiry for each so you can renew on your schedule, not during an incident. ### Auditing a site you inherited Taking over a domain nobody documented? The scorecard tells you in one scan what shape it's in — is HTTPS modern, is email protected from spoofing, are security headers present — instead of discovering each gap the hard way. ### A quick second opinion on a vendor or partner Before you trust a partner's endpoint or send mail on a client's domain, a public audit shows whether their basics (valid certificate, SPF / DMARC , HTTPS) are actually in order. ## Reading the result ### Overall grade A single roll-up of every section, driven by the worst findings — a critical anywhere (expired cert, no DMARC on a mail domain) pulls the whole grade down. It's the one-second answer; the sections tell you why. ### Domain & SSL/TLS Registrar, certificate issuer, and days-until-expiry for both the domain and the certificate. Green means comfortable runway; a warning means a renewal window is approaching; critical means it's expired or about to. ### DNS & Email protection The resolved records plus whether SPF and DMARC are published. Missing email-authentication records don't break your website — they leave your domain open to spoofing, which is why they get their own finding. ### Protocols, headers & performance Which HTTP versions the server negotiates, which security headers are present or missing (with why each matters), and a per-phase timing waterfall so a slow DNS, TLS or first-byte phase is obvious. ## Common pitfalls ### Assuming a green padlock means HTTPS is done right The browser padlock only says the certificate is valid *today*. It says nothing about how many days are left, whether the chain is complete for every client, or whether HSTS is set. The audit checks the parts the padlock hides. ### Forgetting the domain has its own expiry Teams renew certificates and forget the registration behind them. A lapsed domain takes down the site *and* the email *and* the DNS at once, and recovery can take days. The audit tracks that clock separately from the certificate. ### A mail-sending domain with no SPF/DMARC Plenty of sites send transactional email from a domain that publishes no SPF or DMARC policy. It works — until a spoofer sends phishing as you, or a mailbox provider silently junks your real mail. The audit flags the gap before that happens. ### Treating one scan as ongoing safety An audit is a snapshot. Certificates expire, records get edited, headers get dropped in a deploy. The value of a one-off scan is finding what's wrong *now* — catching what breaks *next* needs continuous monitoring. ## Run Smart Website Checker on every change, not just once. Get alerts the moment something breaks — across HTTP, DNS, SSL, RDAP, ping, blacklist and more. Free forever for 10 monitors. No card. [Start free](/auth/sign-up) ## Frequently asked questions What does the website audit check? In one scan: the TLS certificate (issuer, validity, days to expiry), the domain registration and its expiry, DNS records including MX , email-spoofing protection ( SPF / DMARC ), supported HTTP protocols, security headers, and request timing. Each rolls up into a per-section score and one overall grade. Is it free? Do I need to sign up? It's free and needs no signup. Paste a URL and get the full scorecard. A free WatchFor account lets you turn any of these checks into a continuous monitor with alerts. Does it crawl my whole website? No. It checks the infrastructure behind a single URL — certificate, domain, DNS, email posture, headers and protocols — not your pages or content. It's fast and read-only, and never submits forms or logs in. Why does it flag email settings for a website? Because your domain does double duty: it serves the site and (usually) sends mail. A domain without SPF / DMARC can be spoofed by phishers, and your legitimate mail is more likely to land in spam. It's part of a domain's health even if you don't think of it as a "website" problem. How is this different from running separate SSL, DNS and DMARC checkers? It runs all of them at once and grades them together, so you see the whole picture — and which finding is the most urgent — instead of piecing together five tools. Each underlying check is also available on its own if you want to drill in. Can it keep watching my site instead of a one-off scan? Yes. A WatchFor monitor runs these checks on a schedule from locations worldwide and alerts you when a certificate is nearing expiry, a domain is about to lapse, DNS changes, or a security header disappears — through Slack, Discord, PagerDuty and 20+ other channels. --- Canonical page: https://watchfor.io/smart-website-audit · Site guide: https://watchfor.io/llms.txt