How to Check Your Website Security Posture in 60 Seconds
Most website owners focus on making their site look good and load fast. Security is an afterthought — until something goes wrong. The good news: the five most important security checks take under a minute to run, and PostureCheck does all of them for free.
What is Security Posture?
Your security posture is the overall state of your defences — how well your domain and website are protected against common attacks. A good security posture does not mean you are unhackable. It means you have covered the basics that block the majority of automated attacks and reduce your attack surface.
PostureCheck measures five areas and gives you a score from 0 to 100. Here is what each one means.
1. SPF — Sender Policy Framework
SPF is a DNS record that lists which mail servers are authorised to send email from your domain. Without it, anyone can send email pretending to be you. It is one of the simplest records to add and one of the most important.
If your domain is missing SPF, add a TXT record at your root domain: v=spf1 include:_spf.google.com ~all (adjust for your mail provider).
2. DKIM — DomainKeys Identified Mail
DKIM adds a cryptographic signature to every email your domain sends. Recipient mail servers use your public key (stored as a DNS record) to verify the signature. If the email was tampered with in transit, the signature will not match.
DKIM is set up through your email provider — Google Workspace, Microsoft 365, and most email platforms have a setup guide in their admin panel.
3. DMARC — Domain-based Message Authentication
DMARC ties SPF and DKIM together and tells receiving mail servers what to do when a message fails authentication. Without DMARC, even if SPF and DKIM are configured, there is no policy telling servers what to do with spoofed emails.
Add a TXT record at _dmarc.yourdomain.com with value v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com.
4. SSL Certificate
Your SSL certificate encrypts traffic between your server and your visitors. An expired or missing certificate triggers browser warnings that drive visitors away and hurt your Google rankings.
PostureCheck checks whether your certificate is valid, how many days until it expires, who issued it, and whether your server is running a modern TLS version.
5. Security Headers
HTTP security headers are instructions your web server sends to browsers, telling them how to handle your site. They protect against common attacks like clickjacking, cross-site scripting (XSS), and protocol downgrade attacks. PostureCheck checks five headers:
- HSTS — forces browsers to always use HTTPS
- CSP (Content Security Policy) — controls which resources the browser can load
- X-Frame-Options — prevents your site being loaded in an iframe (clickjacking protection)
- X-Content-Type-Options — prevents MIME type sniffing attacks
- Referrer-Policy — controls how much referrer info is passed when clicking links
What Your Score Means
- 80–100: Secure. You have covered the essentials. Keep an eye on your SSL expiry.
- 50–79: At Risk. Some protections are missing. Fix the failing checks before they are exploited.
- 0–49: Vulnerable. Multiple critical protections are absent. Take action now.
Run a free scan on PostureCheck to see where your domain stands right now.