Check a DMARC record: policy, subdomain policy, pct, report addresses and alignment, plus the next record to publish on a safe path from p=none to p=reject.
Tools
Read-only checks for a hacked site, blacklists, and exposed WordPress versions.
Check SPF, DKIM and DMARC for any domain in one go. Plain-English verdict, the 10-lookup SPF limit, a safe DMARC rollout, and copy-paste records for your provider.
Free read-only check for public signs a site is hacked. See what an outside scan can show, and what it cannot see.
Look up any WordPress plugin's latest version, known vulnerabilities by version, and whether the newest release still has an unpatched issue. Free, with sources.
Check an SPF record for syntax errors, duplicate records, a risky +all or ?all, and the 10 DNS lookup limit counted through every nested include.
Check an SSL certificate's expiry date, issuer, hostname match, chain and TLS versions, and find out why a browser says your site is not secure.
Free security headers checker: grades HSTS, Content-Security-Policy, X-Frame-Options, nosniff, Referrer-Policy and cookie flags A+ to F, with copy-paste fixes for nginx, Apache, WordPress and Cloudflare.
Free website blacklist checker: see if your domain is flagged for malware or phishing, or if its mail or web server IP is on an email spam list, with removal steps for each list.
See if WordPress exposes a version in the generator tag or asset URLs, why that is not an exploit test, and why the fix is to update.