How It Works
Inspectors shine light across a surface at a low angle because it shows cracks that flat light hides. Sitewell does the same for your website and email: it looks from the angle an attacker would, using only what anyone on the internet can see, then explains what it found in plain words and who should fix it.
What We Check
Seven things anyone on the internet can see. The score is weighted towards the risks that do the most damage in PNG and the Pacific, led by fake emails sent in your name.
Fake emails sent in your name
Whether scammers can send emails that look like they came from you.
SPF, DKIM, DMARC, MTA-STS, TLS-RPT
The padlock on your site
Whether visitors always get a secure connection.
TLS certificate, HSTS and the HSTS preload list, HTTP to HTTPS redirect, mixed content
Out-of-date website software
Whether your site runs software with known weaknesses or no longer gets safety updates.
Server software, platform, code libraries
Browser protections
Whether your site tells visitors' browsers to block common tricks, and whether those settings actually block them.
Security headers, cookie settings
Protection from attacks
Whether your domain records are protected and your site sits behind a protective network.
DNSSEC, CAA, edge protection
Big email providers' sender rules
Whether your email settings meet the basic rules Gmail, Yahoo and Microsoft set for organisations that send a lot of email, so newsletters and invoices reach inboxes.
Bulk sender requirements: SPF, DKIM, DMARC
A way to report weaknesses
Whether people who find a weakness in your site have a published way to tell you.
security.txt (RFC 9116)
How We Score
Every site gets a score out of 100 for how much best practice it has in place, and one of six grades. The more bars filled, the better protected.
Context counts. A subdomain such as shop.yourcompany.com.pg takes its email protection from yourcompany.com.pg, the same way email providers treat it. A domain that doesn’t handle email only needs to refuse fake emails, so the other email checks don’t count against it. Addresses that don’t exist aren’t scored, and subdomains and email-free domains stay out of the comparison.
Some problems are serious enough to hold a site at C however good the rest is: nothing stopping fake emails in your name, website software that no longer gets safety updates, website code with known weaknesses, or no secure connection.
Who We Compare You With
Your report shows where you stand against established organisations we have checked with the same tests. It started with 204 organisations, and every new site anyone checks joins the comparison, so it keeps getting more accurate.
Each dot is one organisation. We don’t show which, so the comparison can’t be used as a list of easy targets.
| Where | Organisations | Typical score |
|---|---|---|
| PNG | 70 | 50 |
| Pacific | 58 | 52 |
| Australia and New Zealand | 76 | 75 |
Reference figures last re-checked 10 November 2026. Reports use the latest figures.
The Standards We Follow
Each check is based on published guidance, so results line up with what security professionals already use:
- OWASP Secure Headers Project and Mozilla's web security guidelines
- The internet's own email and domain standards (published by the IETF)
- The Australian Signals Directorate's Information Security Manual and its fake-email guidance
- The New Zealand Information Security Manual and NCSC New Zealand guidance
What We Don't Do
We never log in or probe for weaknesses. Sitewell reads public information only, which is why it is safe and legal to run on any organisation. It sees your security from the outside; it doesn't replace a full assessment of your internal systems.
Think a result is wrong? Every report has a link to tell us. We look at it, and if a test got it wrong we fix it for everyone.
What’s Changed
We keep improving the tests. When something changes how sites are scored, it is listed here.
- 10 November 2026A list of approved email senders that names several places that don't exist is now marked as broken, the same way email systems treat it, since they may then ignore the list and let fake emails through. Comparison figures refreshed from a full re-check of every organisation. Script and link settings now only count when they actually protect visitors: a script setting that still lets injected code run, or a link setting that still shares full page addresses with other sites, no longer passes. Sitewell's own pages now meet the stricter rule.
- 9 November 2026Sites that browsers already know to open securely, even on a first visit, now get credit for it. A report now says when a website asks for a login before showing anything, or when its security certificate couldn't be confirmed, instead of calling it a firewall or an error. A site that asks for a login and has no email of its own is no longer given a score of zero.
- 6 November 2026Reports now say whether your email settings meet the basic rules Gmail, Yahoo and Microsoft set for organisations that send a lot of email (shown for information, not scored). A published way to report weaknesses now needs its expiry date to count as complete.
- 5 November 2026Reports now say whether people who find a weakness in your site have a published way to tell you (shown for information, not yet scored). Sender lists that point back to themselves, and WordPress versions too old to get any safety fixes, are now caught.
- 4 November 2026Sender lists that point to another list that doesn't exist are now caught, and when a site's firewall turns our visit away, that block page is no longer scored as if it were the website.
- 4 November 2026The comparison was re-checked in full with today's tests. Sites whose website turned our check away are now kept out of the typical scores, and their reports say only email and domain settings were checked.
- 3 November 2026New check: whether the plain web address sends visitors to the secure site. Links to other websites no longer count as insecure files, and error pages are no longer scored as if they were the website.
- 3 November 2026Fake-email checks are stricter: sender lists that are too long for email systems to read, or that let anyone send, are now caught, and protection that is only being tested or covers just part of your email now scores lower.
- 3 November 2026More out-of-date website code and more email signatures are now recognised, domains that aren't answering on the internet are no longer given a score for records we couldn't read, and every report has a link to tell us if you think a result is wrong.
- 2 November 2026Subdomains now take their email protection from their main domain, the same way email providers treat them, and addresses that don't exist are no longer scored.
- 2 November 2026Domains that don't handle email are now checked only for protection against fake emails, so email checks that don't apply no longer count against them.
- 30 October 2026Comparison widened to 217 organisations, adding Australia and New Zealand, and every new site anyone checks now joins it.
- 30 October 2026Findings rewritten in plain words, with the technical detail kept underneath.
- 30 October 2026Accuracy: words inside a site's own code are no longer mistaken for out-of-date software; Google's network now counts as protection; more email signature types are recognised.
- 30 October 2026New scoring: a score out of 100 with six named grades, and serious problems hold a site at C.
Check Your Site
Free, takes about a minute, and nothing is installed or scanned.