all-in-one website security scanner
Your security gaps,
found in seconds.
Pentrawl checks your domain, email security, TLS, HTTP headers and exposed endpoints in a single automated scan — then explains every finding and shows you how to fix it.
Free · No account required · Scan only domains you own
scan complete
acmecorp.com
scanned 28 Sep 2026 · 21:04 · completed in 4.2s
C
grade
4
issues found
16
checks passed
83/100
score
DNS configuration
PASS
DNS configuration is healthy.
Email authentication
ISSUE
Email authentication needs attention: SPF (~all), DMARC (none).
SPF recordWARN
SPF is set to SoftFail (~all). Unauthorized emails are marked but still delivered.
how to fix
Change your SPF record to end with -all so unauthorized senders are rejected.
DMARC policyISSUE
DMARC is set to none. Spoofed emails are not blocked.
how to fix
Publish a _dmarc record with p=reject and add rua= for reports.
DKIM signingPASS
DKIM is configured and signing outgoing mail.
No action needed — correctly configured.
Security headers
ISSUE
5 of 6 security headers are missing.
SSL / TLS certificate
PASS
SSL/TLS certificate is valid and correctly configured.
WordPress
PASS
WordPress not detected.
Sensitive files
PASS
No sensitive files are publicly accessible.
Endpoint discovery
ISSUE
1 exposed endpoint found.
Link crawler
PASS
No external API endpoints exposing data were found.
Everything you'd check separately, in one scan.
Most security checkers do one job well and ignore the rest. That's exactly where problems slip through — a perfect SSL score means nothing if your email can be spoofed. Pentrawl brings them all together in one automated scan.
DNS checker
SSL checker
SPF checker
DMARC checker
headers checker
endpoint scanner
20+ checks · One scan · Zero setup
What Pentrawl checks
Six layers of your website, in one scan
Email spoofing
Can others send email as you? We check SPF, DKIM and DMARC.
SSL / TLS
Is your certificate valid and your connection encrypted?
Security headers
Does your server protect visitors? HSTS, CSP, X-Frame and more.
Exposed files
Are sensitive files or admin panels accidentally public?
DNS & domain
Is your domain set up correctly? Records, DNSSEC and CAA.
CMS & plugins
Running WordPress? We flag outdated plugins with known CVEs.
How it works
From domain to fixes in three steps
01
Paste your domain
No account, no setup. Just enter the website you want to check.
02
We run 20+ checks
Pentrawl scans every layer of your site in a single automated pass.
03
Get a clear report
Every finding explained, with the exact fix. Download as PDF.
See what your website reveals.
One scan. Everything checked. Nothing left unexplained.