Step-by-Step Guides to Building and Growing Your Website
Six quick checks tell you whether an online store is legit, and the padlock is not one of them. I measured 26 well-known shops on domain age, certificates and the policy and contact pages they publish to see what normal looks like.
A basic website security check is six small tests. I ran them on 68 well-known sites and on my own two, and found that the connection basics pass almost everywhere while three optional records are missing on most.
A vulnerability scan is mostly a version lookup. I checked all 25 plugins on this site against WPScan and Patchstack, found 67 to 69 known flaws and none that applied, and saw where the two databases disagreed.
A free malware scan only sees what a visitor sees. A live run of 69 well-known sites through Sucuri SiteCheck shows what it finds, the false alarms and blocked scans, and the server-side checks that fill the gap.
You can read a WordPress theme in ten seconds and a few plugins in a minute. A live check of 29 real sites and this site’s own 24 plugins shows how much a theme and plugin detector can see.
A security headers check reads six response headers. A live survey of 63 well-known sites shows which ones are common, what WordPress and the host send by default, and a safe order for adding them.
Four free checks can name a site’s host: IP owner, nameservers, headers and page source. A live survey of 69 well-known sites shows which ones work and why a CDN hides the host on seven sites in ten.
Yes, but extra MX records are for one provider’s redundancy, not for running two. How priority and failover work under RFC 5321, what 69 real domains publish, and how to switch providers without losing mail.
Shopify does not host mailboxes. What it does give you for business email, the sender-address rewrite that catches new stores, and what 29 well-known Shopify stores run on their own domains.
Blacklists list sending IPs and domains, not mailboxes. How to check one by hand, a live test showing Spamhaus returns a false ‘clean’ through some public resolvers, and what to do if you are listed.