Your website’s security.
One grade. Every fix.
Discover hidden website security weaknesses before attackers do. Get an A–F security grade and exact fixes in seconds.
Could someone send email pretending to be you@yourdomain.com? Find out in 3 seconds.
Opens a live investigation of your domain · The full A–F grade runs in the free Chrome extension
How a check works
From first scan to a better grade, in four steps.
Scroll to follow one check through its journey. Illustration, not a real site.
- 01Scan
You click the extension on any site. It reads headers, HTTPS, cookies, email records and public subdomains.
- 02Find
Each issue is ranked by severity and explained in plain English, and the grade reflects what was found.
- 03Fix
You copy the exact config for your server, host or DNS and deploy it.
- 04Grade A
Once the issues are fixed, a re-check shows the higher score. Then send the client a report, or keep the site on your watchlist.
Why it exists
Most checkers stop at headers. A real review covers cookies, email spoofing, old libraries and the subdomains attackers find first. SurfaceWatch grades all of it.
What it checks
Six layers. One grade.
Everything an outsider can see about your site, rolled into a score you can explain to a client in one sentence.
Security headers
CSP quality, clickjacking protection, referrer and permissions policy, and version leaks, each with the exact fix.
HTTPS & HSTS
Encrypted, redirected from HTTP, and forced to stay that way.
Cookies
Session cookies missing Secure, HttpOnly or SameSite. Analytics cookies are left out.
Email spoofing
SPF, DMARC and CAA, so nobody can send mail pretending to be your client.
Page & code
Mixed content, insecure forms, scripts without integrity checks, and outdated libraries.
Attack surface
Subdomains from public certificate logs, with admin, dev and staging systems flagged before an attacker finds them.
Inside the extension
See the full report
This is what the extension shows for any site: the A–F grade, the scorecard and a fix for every issue. Type your agency and client name to white-label it. Sample data.
Install the extension to check real sites, including cookies and page content.
Private by design
Nothing to sign up for. Nothing sent to us.
SurfaceWatch runs in your browser and reads only what a site already shows every visitor. There is no server of ours in the middle.
The free version needs no sign-up. Pro uses a license key from Gumroad.
No ads, no tracking, and no one watching which sites you check.
Small and quick. Results and your watchlist stay in your browser.
Exactly what leaves your browser
To do its checks, SurfaceWatch makes a few lookups to public services. That is the complete list.
To read SPF, DMARC and CAA records.
To list subdomains from public certificate logs.
Pro only, to verify it about once a day.
Cookie values are never stored or sent. Read the full privacy policy ›
Compare
How SurfaceWatch compares.
Security Headers and Mozilla Observatory are good, trusted tools. They check a slice. SurfaceWatch grades the whole surface. Here is where each one fits.
| Feature | Security Headers | Mozilla Observatory | SurfaceWatch |
|---|---|---|---|
| Security headers | ✓ | ✓ | ✓ |
| HTTPS & HSTS | partial | ✓ | ✓ |
| Cookie flags | – | ✓ | ✓ |
| SPF & DMARC email checks | – | – | ✓ |
| Outdated JavaScript libraries | – | – | ✓ |
| Exposed subdomains | – | – | ✓ |
| Checks pages you are logged in to, or staging | – | – | ✓ |
| Copy-paste fixes per platform | some | recommendations | ✓ |
| Client reports and monitoring | – | – | Pro |
| Hosted scanner or API, no install | ✓ | ✓ | – |
Where they win: if you want a hosted scan with nothing to install, or an API for your CI pipeline, use Security Headers or Observatory. Many people run both alongside SurfaceWatch. Read the details: vs Security Headers · vs Mozilla Observatory. Based on each tool's public documentation, October 2026; tools change.
Pricing
Free forever. Pro when you grow.
Start with everything you need at no cost. Upgrade inside the extension for client work, with a 14-day money-back guarantee.
Free
Grade a site, get the fix
$0forever
Add to Chrome (Free)- ✓Unlimited one-click checks of any site
- ✓Full A–F grade, scorecard and every issue
- ✓Copy-paste fixes for every platform
- ✓Grade on your toolbar and score changes
- ✓Watch 1 site · 3 subdomains shown
Pro
For agencies and freelancers
$7/month
Billed monthly through Gumroad.
Add to Chrome, then upgrade inside- ✓ Everything in Free
- ✓ White-label PDF reports with your logo and your client's name
- ✓ Watch 25 sites with daily checks and alerts
- ✓ Bulk-check 25 sites and export CSV
- ✓ Every subdomain and a score history chart
Founding member offer · first 30 people
Pro yearly for $29.50 $59: 50% off your first year.
Code FOUNDER is applied for you. It renews at the normal price after year one, and the 14-day money-back guarantee still applies. Install the free extension, then paste your license key in Settings.
Daily checks run while Chrome is open. Pro is billed through Gumroad.
Questions?
Answers.
How is this different from a "security headers" checker?
Header checkers only read your HTTP response headers. SurfaceWatch grades your whole surface: headers plus HTTPS/HSTS, cookie flags, SPF/DMARC email spoofing, outdated JavaScript, and exposed subdomains. Then it gives one A–F grade and the exact fix for each.
Does it scan or attack the site?
No. The checks are passive. It only reads information already exposed to any visitor: headers, cookies set in your browser, public DNS and certificate logs. It never probes or attacks the site, so it is safe to run on sites you do not own.
Does it check every page of my site?
It checks the page you open, plus domain-level signals (email DNS and subdomains) that cover the whole domain. It does not crawl every URL. For a thorough review, check your key pages individually: home, login, checkout. Page content like scripts, forms and libraries can differ from page to page.
Do I need an account?
No. The free version needs no account and no sign-up. Pro is activated with a license key you receive after purchase through Gumroad.
What data leaves my browser?
SurfaceWatch has no server of its own and runs no analytics. To do its checks it makes lookups to public sources: domain names go to Google Public DNS, and to crt.sh for public subdomains. Your results and watchlist stay in your browser. See the privacy page for detail.
Is it free?
Yes. Unlimited one-click checks, the full grade and every copy-paste fix are free. Pro ($7 a month or $59 a year, with a 14-day money-back guarantee) adds monitoring for 25 sites, bulk checks and branded client reports.
Can I trust the fixes?
The header, HTTPS, cookie and DNS fixes are safe to paste. The one exception is Content-Security-Policy: ship it in report-only mode first and tune it to your site, because a strict CSP can break your own scripts. SurfaceWatch flags this for you.