Defaults.Exposed › Frequently Asked Questions
Frequently Asked Questions
Short, straight answers to the things owners ask us most. If your question isn’t here, the short version is usually: yes, checking is free; the scan only reads what your domain publishes and makes the same few requests any visitor’s browser makes; and it is meant for domains you own or look after.
Is checking my domain free?
Yes. Checking your own domain is free, and it stays free. The fix guides are free too, and the fixes themselves are settings changes on systems you already pay for. We also sell one optional product, the A-Grade Playbook: your domain’s own fix steps, with the exact values, in a safe order. You never need it to find out what is wrong or how to fix it. Prices are on the pricing page.
Is it safe? Will it harm my website?
No, it won’t harm anything. The scan looks up your domain’s public DNS (Domain Name System) records (SPF, DMARC, DKIM, DNSSEC, MX, CAA), completes a TLS (Transport Layer Security) handshake to read your certificate, and sends one HEAD or GET request to your home page to read the security headers, following one redirect on the same site if there is one. That is the same kind of traffic any visitor’s browser sends. We don’t log in, we don’t submit forms, and we don’t change a single thing. The crawler page lists exactly what it does.
Do you store my data? Do you sell it?
We never sell your data. We do store some, and we share some with advertising platforms. When you run a scan, we log the domain, your IP (Internet Protocol) address and rough location, the page you came from, and a random visitor id for your browser, together with the grade and the public findings. If you give us your email address, we keep it with your request and a note of whether you agreed to marketing email. The site also runs Google Analytics and two advertising pixels, from Meta and Reddit. They load when a page opens, without asking first. Google Analytics counts visits and scans. The Meta and Reddit pixels report your visits to those companies so we can measure our ads, and the platforms can use those visits to build ad audiences. Our server also reports completed scans to Meta, and to Reddit when you arrived from a Reddit ad. You can switch Google Analytics, the pixels and the server reports off for your browser at /optout. The Privacy Policy and Cookie Notice give the full list.
How does the grade work?
We run 33 checks across four areas (email protection, encryption, your website’s setup, and your domain’s wider settings) and turn the results into a simple A-to-F grade. A means strong; F means important basics are missing. You don’t need to understand the individual checks; the grade tells you where you stand at a glance.
See the methodology page for the full breakdown.
What do I actually get?
You get your domain’s grade, a plain-English summary of what’s working and what isn’t, and clear pointers on what to fix first. The aim is simple: tell you, in words you can act on, what to hand to whoever looks after your website and email.
Who can see my domain’s grade?
Anyone who runs a scan of it. Every check reads what your domain already publishes to the internet, the same records a customer’s mail server or a criminal can read, so the grade is a summary of public facts. The scan does not verify ownership. Our acceptable use rules allow checking only domains you own or are responsible for. What we never do is publish per-domain grades as pages, lists or league tables. The data we publish is aggregate: patterns across many domains.
Do I have to be technical?
Not at all. You don’t need to fix anything yourself. We give you a short, clear summary you can forward to whoever runs your website or email, your web person, your IT provider, or your hosting company. They’ll know exactly what to do with it.
Where is my data held?
In more than one place. Our own servers, which hold the scan logs and our database, are with OVH in the EU (France and Germany). Some of the services we use are in the United States: Google Analytics, Meta and Reddit for analytics and ad measurement, Resend for outbound email, and Stripe for payments. Cloudflare, which sits in front of the whole site, runs a global network. The Privacy Policy lists every recipient and where it is.
Who are you?
We’re an independent domain-security service. We built a large, ongoing census of domains across the internet and graded each one the same way, so we can show owners how their domain measures up. We’re not tied to your hosting provider. The check and the fix guides are free, and the one thing we sell is the optional A-Grade Playbook.