Cookie and consent check
Looks at your site the way a visitor who has not consented sees it: do tracking scripts such as Google Analytics, Meta Pixel, Hotjar, Yandex or TikTok load before consent, does the server set tracking cookies before consent, and is there a consent tool and a cookie policy link. Under Turkey's KVKK cookie guidance and the GDPR, non-essential cookies need explicit consent. No ownership needed, one request.
Other tests
Security headers test
Grades HSTS, CSP depth, CORS, SRI, mixed content and cookie settings.
SSL/TLS check
Certificate chain, protocols, weak ciphers.
Email security check
SPF, DKIM and DMARC: can someone send fake email in your name?
Attack surface reconnaissance
Passive OSINT: subdomains, dangling records, technology stack, DNS and ASN; what an attacker sees during recon.
Subdomain scanner
Every subdomain of your domain: resolution, first seen, dangling records and takeover signals.
DNS and domain security check
DNSSEC, CAA, name servers and the domain registration: lock, expiry date.