FALKEN'S MAZE / CHECKS
The checks
Everything Joshua looks at when it scores a domain, and which plan runs it. Pick a check to see why it matters and how to fix it.
Email authentication
SPF record Free
Checks that the domain publishes a valid SPF record.
DKIM signing Free
Looks for DKIM public keys on common selectors.
DMARC policy Free
Checks for a DMARC record and how strict its policy is.
Mail servers Free
Checks that MX records resolve.
SPF lookup limit Pro (Watchtower)
Counts DNS lookups in the SPF record against the limit of 10.
DMARC alignment Pro (Watchtower)
Checks that SPF and DKIM are both set up on the From domain, so they can align, and that DMARC reports are collected.
MTA-STS and TLS-RPT Pro (Watchtower)
Checks for an MTA-STS policy that makes senders deliver your mail over TLS, and a TLS-RPT record for failure reports.
BIMI Pro (Watchtower)
Checks for a BIMI record that shows your logo next to your mail in supporting inboxes. Only ever a warning.
DNS
DNSSEC Free
Checks whether the zone is signed with DNSSEC.
CAA record Free
Checks for a CAA record limiting which authorities may issue certificates.
Nameserver redundancy Free
Checks for at least two nameservers.
Domain registration expiry Free
Looks up when the domain's registration expires, from the registry's RDAP service.
TLS / certificates
Certificate validity Free
Checks that the certificate is valid, trusted and matches the hostname.
Certificate expiry Free
Warns when the certificate expires within 14 days.
Legacy TLS versions Free
Checks whether TLS 1.0 or 1.1 are still enabled.
HSTS Free
Checks for a Strict-Transport-Security header.
HTTP redirects to HTTPS Free
Checks that plain HTTP requests are redirected to HTTPS, on the first hop.
Mixed content Free
Looks for scripts, stylesheets, frames and images loaded over plain HTTP on the HTTPS home page.
Cipher suites Pro (Watchtower)
Tests which outdated TLS 1.2 cipher suites the server accepts.
Security headers
Content-Security-Policy Free
Checks for a Content-Security-Policy header.
Clickjacking protection Free
Checks for X-Frame-Options or a frame-ancestors directive.
Referrer-Policy Free
Checks for a Referrer-Policy header.
Permissions-Policy Free
Checks for a Permissions-Policy header.
X-Content-Type-Options Free
Checks for an X-Content-Type-Options: nosniff header.
Cookie flags Free
Checks the Secure, HttpOnly and SameSite flags on cookies the home page sets.
Exposure
Server version leakage Pro (Watchtower)
Looks for software versions in Server and X-Powered-By headers.
security.txt Free
Checks for a /.well-known/security.txt file with a contact and an expiry date.
robots.txt Free
Reads robots.txt for Disallow lines that point to backups, staging copies, admin panels or config files.
PHP version Pro (Watchtower)
When the X-Powered-By header gives the PHP version away, checks that php.net still supports it. Skipped for sites that hide it.
Subdomains
Subdomain discovery Pro (Watchtower)
Finds subdomains through certificate transparency logs.
Subdomain takeover Pro (Watchtower)
Detects CNAMEs pointing at deprovisioned cloud services.
Blacklists
Email blacklists Pro (Watchtower)
Checks mail servers and the domain against major DNS blocklists.
WordPress (Plugin Recon)
WordPress core version Plugin Recon
Detects the WordPress core version and compares it to the latest release.
Plugin versions Plugin Recon
Finds visible plugins in page source and checks their versions against WordPress.org.
User enumeration Plugin Recon
Checks whether usernames are exposed through the REST API or author archives.
Theme versions Plugin Recon
Finds the theme the home page loads (and its parent theme) and checks its version against WordPress.org. With the Plugin Recon WordPress plugin, every installed theme.
XML-RPC Plugin Recon
Checks whether xmlrpc.php is reachable.
Known vulnerabilities Plugin Recon
Looks up the installed WordPress, plugin and theme versions in the Wordfence Intelligence vulnerability database (copyright Defiant Inc.). With the Plugin Recon WordPress plugin, every installed plugin and theme.
Exposed files Plugin Recon
Looks for debug logs, backups and directory listings in wp-content.
PHP and WordPress settings Plugin Recon
Uses the Plugin Recon WordPress plugin to check the PHP version, error display, the built-in file editor and automatic core updates.
Abandoned plugins Plugin Recon
Flags plugins with no WordPress.org release in two years, even when the installed version is the latest. With the Plugin Recon WordPress plugin, every installed plugin.
Login protection Plugin Recon
Uses the Plugin Recon WordPress plugin's list of plugins to check that a public wp-login.php has a plugin limiting login attempts or adding two-factor sign-in.
The free checks run on every report card. Scan a domain or see how scoring works.