If you build or maintain websites for clients, you have heard the question: "So... is my site actually secure?" For a long time my honest answer was a shrug and "well, it has HTTPS." Not exactly the confident, professional response a paying client wants to hear.
So I built a repeatable 2-minute workflow that lets me hand any client a clear, graded security report - and it has made me look a lot more like a pro (and occasionally saved a client from a very bad week). Here's the whole thing.
What "secure" actually means (beyond the padlock)
A green padlock means the connection is encrypted. It says nothing about the half-dozen other things that actually get sites compromised. When I review a client site now, I look at six layers:
- HTTPS and HSTS - does
http://redirect tohttps://, and is HSTS set so browsers never downgrade? - Security headers - Content-Security-Policy, clickjacking protection, and the other recommended headers. Missing these is the #1 thing I find.
- Cookies - are session cookies marked Secure, HttpOnly and SameSite? Easy to miss, easy to fix.
- Email spoofing (SPF / DMARC) - can someone send email as the client's domain? Scary for anyone doing client comms or invoicing.
- Page content - mixed content, insecure forms, and front-end libraries with known CVEs.
- Exposed subdomains - forgotten
staging.,dev.oradmin.subdomains sitting in public certificate logs.
A genuinely "secure" site needs all six in reasonable shape - not just the padlock.
The 2-minute workflow
I used to check these one at a time across five different websites (SSL Labs for TLS, a headers checker, a DNS tool for SPF/DMARC). It was tedious, so I never did it consistently.
Now I run one tool. I use a free Chrome extension called SurfaceWatch: I open the client's site, click once, and about a second later I get an A-F grade with every issue sorted by severity and the exact fix (the config snippet for whatever stack the site runs on).
What makes it land with clients is the "Security at a glance" scorecard at the top of the report: six cards - HTTPS, headers, cookies, email, page content and attack surface - each showing clean, issues, or not fully checked, so a non-technical client sees exactly where the problems are in one look. Under it, a plain-English line explains what the grade means. No jargon wall.
It is passive - it only reads what the site already shows every visitor, so it is safe to run on sites you do not own, including staging and logged-in pages a hosted scanner cannot reach.
Turning it into a client deliverable
The grade is useful for me. What makes clients happy is a report with their name on it. Here is how I package it:
- Run the check, note the grade and the top 2-3 issues.
- When I want it polished, SurfaceWatch's Pro tier generates a white-label PDF with my logo, the client's name, a plain-English summary and a score-history chart. I hand that over and it looks like a proper audit - because it is one.
- Before I paid for anything, I used the free preview of that branded report (a watermarked sample of exactly what the client version looks like) to decide it was worth it. You see the deliverable before you upgrade.
- Then I quote the fixes (most are a 10-minute config change) as part of the engagement, or as a small security add-on.
That last part matters. "Here's your security grade, and here's what it costs to get you to an A" is a genuinely good upsell. The client gets peace of mind; you get a repeatable service line.
The habit that actually pays off
The real unlock is not the tool - it is making this a standard step in your workflow: run a security check before every handoff, and re-check live client sites periodically. (SurfaceWatch's watchlist re-checks and alerts me when a grade drops, which has caught a couple of regressions before the client noticed.)
It takes two minutes, it makes you look like the professional you already are, and every so often it catches something that would have been a very bad week for your client.
If you want the exact tool I use, it is free on the Chrome Web Store - search SurfaceWatch. But honestly, even if you use something else: just start running the check. Your clients will notice.