Updated
What Kiplock checks
Secure connection: HTTPS, the certificate, and the security settings browsers use to protect visitors.
Exposed files and logins: settings files, backups and login pages that should never be public. This is checked only on sites whose owner has verified them.
Cookies and trackers: which tracking tools and cookies load, and whether visitors are asked first.
Personal details in forms: forms that collect names, emails or health details, where they send them, and what else runs on the page.
Email protection: SPF, DKIM and DMARC, so nobody can easily send email pretending to be you.
Accessibility basics: image descriptions, form labels, contrast and headings. A quick check, not a full audit.
How the score works
Each check gets a score out of 100 and a grade. Every problem comes with what it means in plain words, why it matters and how to fix it. Paid plans add ready-to-paste fix settings, PDF reports, scheduled checks and alerts.
How Kiplock checks safely
It looks only at what any visitor can see. It does not log in, guess passwords or try to break anything.
It identifies itself: its user agent names Kiplock and links to a page about it.
On basic checks it honours robots.txt. Deeper checks run only on sites the owner has verified.
Site owners can ask for a correction, a report to be taken down, or an opt-out on the site owners page.
What Kiplock does not do
It is an automated check of what is publicly visible. It is not a penetration test, results can change, and no findings does not mean a site is secure. It is not legal certification or legal advice: please verify every finding independently.
Common questions
Is Kiplock free?
Yes. Checking a website once is free with no account, and so are the email, SSL, domain expiry and blocklist tools. Paid plans add fixes, PDF reports, scheduled checks and alerts.
Does Kiplock make my site GDPR or HIPAA compliant?
No. Kiplock gives a best-practice assessment of security and privacy signals. It is not a legal certification.
Can I scan any website?
You confirm you are allowed to check the site. Basic checks read only public information and respect robots.txt; deeper checks need ownership to be verified.
Which countries is it available in?
The US, the UK, Canada, Australia, New Zealand and the EU for now.