Store Sheriff → Scan your store
Check your store from the outside
Enter your store address. This looks at what your store already shows the public — certificate, redirects, platform, leaked version numbers, security headers, compression, how fast the server answers — and tells you what that says about how well it is being looked after. No login, no email, no access to anything private.
Only check stores you own or look after. Takes a few seconds.
What your store shows the public
Checked:
Findings
Now the half nobody can see from outside
The checks above are everything your store tells the public. They cannot see the things that actually end businesses: whether your backups work, whether anyone has ever restored one, who still has admin access, and whether anybody would find out if checkout broke tonight.
The full check asks eighteen questions covering those too — and it will arrive already filled in with what was just measured, so you only answer what genuinely needs inside knowledge.
What this can and cannot see
It can see
Anything your store already serves to every visitor: your TLS certificate and when it expires, whether http redirects to https, which platform you run and any version numbers the pages announce, the PHP version if your server broadcasts it, which security headers are set, whether pages are compressed, how long the server takes to answer, and whether a secure page is loading insecure resources.
It cannot see
Anything behind your login. It does not know whether your backups exist or work, which plugins are installed, how many admin accounts you have, or whether anyone is watching the store. It is one request to one public page — not an audit.
What it deliberately does not do
It does not probe for hidden files, configuration backups, exposed repositories, admin pages or user lists. Those probes are how you find vulnerabilities in a site, and a public tool should not run them against a domain it cannot verify you own. We fetch the page you give us and, at most, robots.txt — files that are meant to be fetched. Requests to private, internal and non-routable addresses are refused outright.
Nothing is stored
The address you enter is used to make the request and is not logged to any database or sent anywhere else. There is no account and no tracking. Full detail on the privacy page.
Related
- The full 18-point check — including the things only you can answer.
- Which PHP versions still get security fixes
- Is your store platform still supported?
- What managed hosting actually does — if the finding above is a slow server.