Wolf-Dark mode is on. Should this browser remember the choice for future visits?
Three free checks · Free browser findings · Order files separately
Check the publicly visible configuration of a website, email domain or API endpoint. First choose the subject of your check. On the relevant scanner page, enter the target and see which features will be examined.
Web Security Check
See which security headers, HTTPS settings and other features your website exposes externally. The Web Check examines the specified address and selected features of the observed responses, such as headers and cookies.
Your input: a publicly accessible website address. The check does not crawl the entire website or test processes behind a sign-in.
Email Security Check
Assess published settings for sending email and its transport. The domain check examines SPF, discoverable DKIM keys and DMARC, as well as signals from reachable mail servers and MTA-STS publications.
Your input: the domain whose email configuration you want to examine. The check does not read a mailbox or examine the content or authentication of an individual message. A published DKIM key alone does not prove a valid email signature.
API Security Check
Examine CORS, security headers and limited response signals at an HTTP/API endpoint. These include visible indicators such as rate-limit headers and selected error responses.
Your input: the public endpoint URL, including its path if needed, without access tokens or confidential data. The check does not examine user permissions or business logic. Visible rate-limit headers do not prove effective limits under load.
On narrow screens, scroll the table sideways.
| Your question | Suitable starting point | What remains open |
|---|---|---|
| Which headers does my website return after a hosting change? | Web Security Check | Other paths, sign-in processes and the effect in a particular browser context |
| Which SPF, DKIM and DMARC settings does my domain publish? | Email Security Check | Whether an individual message authenticates successfully or reaches an inbox |
| What does a public API endpoint show about CORS and headers? | API Security Check | Authenticated access, user permissions, business logic and behaviour under load |
| How can I record and share a finding? | Run the relevant check, then use the offered report | Your own assessment, responsibility and further examination of the finding |
A domain can provide a website, email and API services. If several of these areas matter to your task, check them separately. A Web result does not answer an email question.
Only check targets you operate or are authorised to assess. Scanner terms of use
A different file type does not extend the check scope. Save the files you need locally. Downloading again uses the existing measurement while it remains available; start a new check yourself if you need a new measurement.
All three checks offer German and English views and report files where the saved model supports them. If an older result cannot be reconstructed reliably in English, its original German version remains available within the original access period.
The Web guides and Email guides explain configuration features and suitable next steps. To assess an individual message, the section on header findings explains the trust boundaries.
Organisational self-assessments are separate in the NIS2 section with country guidance. A technical scan and its report do not establish NIS2 compliance.
Public Web, Email and API checks and their browser findings are free, without an account or email address. New report files are ordered separately. You see the price, scope, taxes and terms before placing a binding order. Existing free file access retains its original validity.
Ordering files requires an email address for contract delivery. A single report is also available without an account as a guest. A separately confirmed recovery contact is optional. Free browser findings do not require an email address.
The domain check examines published domain and mail-server signals. It does not read mailboxes, analyse attachments or confirm a person’s identity or reliable delivery. Assessing an individual message requires separate consideration of its headers and actual delivery path.
No. A+ is the highest grade, but it applies only to the relevant check and measurement time. Criteria, grades and the ability to assess a result differ between scanners. Unmeasured points remain open; errors and limited measurements are possible. The checks do not replace a penetration test or a full legal or organisational review.
No. This check examines a specified public HTTP/API endpoint. Programmatic access to the Wolf scanners would be a different service. This check provides no usable Wolf API endpoints, access keys or integrations.
Yes. Browser findings and purchase preparations have short lifetimes; a separately purchased original remains in the purchase archive for three calendar years from first delivery. See the privacy policy for data and retention details. Existing free file access keeps its original lifetime.