A free public configuration scan for any website — TLS, DNS, email authentication and HTTP headers, checked against published standards. No sign-up, no charge.
By scanning, you agree to the .
36 standards checks across 3 layers · results in seconds ·
Running a live scan…
A public configuration check. Nothing is stored about you.
Public config scan · not a certification
A high score does not mean a site is secure. A low score does not mean the site owner is dishonest, unsafe, or untrustworthy. The score only reflects the public configuration checks shown below, at the time of scanning.
Some trust seals are sold — a badge for your footer, often a fee every year. Those can have a place. But a signal you buy isn't quite the same as one you earn by passing a check anyone can re-run and verify. We wanted the second kind, freely available to everyone.
We think it should work the other way around. The checks that actually matter — a valid certificate, modern TLS, SPF and DMARC so nobody can spoof your email, headers that stop clickjacking — are standards, not premium features. Testing them costs us almost nothing, so it should cost you nothing too. Run it on your own site, a supplier's, a competitor's. No account, no catch, no badge for sale.
And the seal? In Ireland the seal is a keystone species — what marine folk call a "doctor of the sea," because it keeps the whole system healthy by spotting the weak and the sick. That's exactly what a good security scan does. So our seal of approval is a literal seal. Earned, not bought.
There are paid trust marks that assess a business and award a reusable mark. That can be useful. trustscan is a different thing — a free, instant, public configuration scan. Neither is a guarantee a site is safe; both look at signals. The difference is how you get there.
| trustscan.ie | Paid trust-mark model | |
|---|---|---|
| Cost | Free | Paid assessment |
| Speed | Instant scan | Assessment process |
| Data required | A domain | Business & contact details |
| Output | Public technical report | A mark / scorecard |
| Method | 36 checks, all visible | Provider-defined |
| What it claims | A config scan, not certification | A mark awarded by the provider |
If it saves you a headache and you'd like to chip in, you can feed the seal a fish. Entirely optional — the scan stays free either way.
No black box. Every domain runs the same 36 checks across three layers. Each check passes, partly passes, or fails — and a handful are informational and don't affect the grade. Here's the exact arithmetic.
A category's score is the points earned divided by the points available, as a percentage. Informational and not-applicable checks are left out of the maths so they never inflate or deflate a result.
The overall score is a weighted average. A broken transport layer undermines everything above it, so it carries the most weight.
Every check maps to a published standard — an IETF RFC, a W3C/WHATWG specification, or a documented vulnerability. For each one: what it is, what we test, why it matters, and a link to the source so you can verify it yourself. Nothing here is our opinion; it's the spec.
Plain English, because that's the whole point. Using trustscan.ie means you agree to what's below. If you don't, please don't use it.
A high score does not mean a site is secure. A low score does not mean the site owner is dishonest, unsafe, or untrustworthy. The score only reflects the public configuration checks shown in the report at the time of scanning.
trustscan.ie is a free tool that reads the publicly visible configuration of a website and domain — the information public web, DNS and mail systems intentionally publish or return during normal connection. It checks that configuration against the trustscan test norm and shows how the score was calculated.
trustscan.ie is not a security audit, penetration test, certification, endorsement, guarantee, or statement about the people or business behind a site. A result is a machine-generated, point-in-time observation of public technical configuration only.
You may use trustscan.ie to request a light-touch scan of a domain’s publicly visible configuration. You are responsible for using the service lawfully and appropriately. A domain being publicly reachable does not give you permission to misuse the service, overload a system, bypass safeguards, or present a result in a misleading or harmful way.
trustscan.ie is designed to read only information that public web, DNS and mail systems intentionally publish or return during normal connection. It does not attempt to bypass authentication, defeat access controls, exploit vulnerabilities, intercept private communications, or access non-public areas.
trustscan.ie does not test whether a website is free from malware, scams, phishing, data breaches, vulnerable software, insecure code, weak passwords, exposed admin panels, payment fraud, privacy issues, or business misconduct. It only checks the public configuration signals listed in the report.
We try to make results accurate, but automated checks can be wrong, incomplete, blocked, cached, or out of date. DNS, TLS and HTTP configuration can change at any time. A result should always be read together with its scan date and the detailed checks shown underneath the grade.
Using trustscan.ie does not create a consultant-client, auditor-client, solicitor-client, or professional advisory relationship. The report is general technical information, not advice tailored to your organisation.
Do not rely on a trustscan result or badge as your only basis for deciding whether to visit, buy from, contract with, insure, assess, approve, or reject a website or organisation. The result is one technical signal, not a complete risk assessment.
If you share a trustscan result, you must share it fairly and in context. Do not crop out the scan date, domain, limitations, or “not a certification” wording. Do not use a result to suggest that trustscan.ie has endorsed, certified, condemned, investigated, or made a statement about any person or business.
We may change checks, weights, thresholds, wording, references, or scoring rules as standards and best practice evolve. A grade produced on one date may not be directly comparable with a grade produced later.
The badge is available only for strong results (grade A or A+). It is a live image that includes the domain, the grade, the scan date, “public configuration scan” and “not a certification”, and it links back to a matching scan.
You must not alter, crop, re-label, re-host, forge, or present a trustscan badge or result in a misleading way. A badge may only be used for the domain shown on the badge and must link back to the matching trustscan report. It must not be described as a certification, endorsement, or guarantee.
We may refuse, throttle, block, remove, or suspend access to trustscan.ie where we believe the service is being misused, automated at abusive volume, used to harass others, used to misrepresent results, used to bypass safeguards, or used in a way that may create legal, security or operational risk.
No bulk or automated use is allowed unless we have agreed it in writing. Do not scrape, script, mirror, resell, benchmark, or repeatedly query the service in a way that bypasses rate limits or causes unnecessary load on trustscan.ie or any scanned target.
If you own or represent a scanned domain and believe a result is wrong, stale, misleading, or should not be available on trustscan.ie, contact hello@trustscan.ie. We can remove a cached result, trigger a fresh scan, or add a clarification where appropriate. We may ask you to prove control of the domain before making changes.
You can also opt a domain out entirely by publishing a DNS TXT record: trustscan=disallow. When present, we refuse to scan that domain and issue no badge.
You do not need an account to use trustscan.ie. We process the domain you submit so we can run the scan and display the result. We store the scanned domain, grade and timestamp so the result can be cached and the service can avoid repeatedly scanning the same target. We do not use this information to identify you.
We also keep a short security log — your IP address, browser user-agent, the target and the action — solely for abuse prevention, rate limiting and incident response. We do not use it to track you or build a profile.
Cached results are kept for 15 minutes unless refreshed or removed earlier — we do not keep public report pages. Security logs are kept for 30 days unless needed to investigate misuse or protect the service. Nothing here changes your rights under the GDPR or the Data Protection Act 2018; contact us to access or delete data we hold about you.
If you find a vulnerability in trustscan.ie, or a way to make the scanner reach private systems, overload targets, bypass rate limits, or produce misleading results, please email security@trustscan.ie. Please do not test against systems you do not own, and do not access, alter, delete or disclose anyone else’s data. We will acknowledge good-faith reports and fix issues as quickly as we reasonably can.
trustscan.ie is provided free of charge, on an “as is” and “as available” basis. We do not promise that the service will be uninterrupted, error-free, complete, current, or suitable for any particular purpose, and we do not promise that a scanned site is secure or insecure. To the fullest extent permitted by Irish law, we are not liable for loss arising from use of the service, inability to use it, or reliance on a result. Nothing in these Terms excludes or limits liability that cannot legally be excluded or limited.
These Terms are governed by the laws of Ireland, and the Irish courts have jurisdiction. We may update them; the current version always lives on this page. Questions: hello@trustscan.ie.