Assess
Check a domain
Run a free check against the public security configuration of a domain you control.
DNS, email authentication, TLS, headers and public technology. Exposed services need the verified check.
Learn
Learn cyber security
Understand common security controls, assess your current position and use free tools to check the public configuration of your websites and domains.
Free tools
Check a specific control
Use a focused checker for email authentication, DNS, TLS or HTTP security configuration.
Popular: DMARC, SPF, SSL/TLS, security headers.
Get started
New to cyber security?
Learn the model behind every control: what you protect, what could go wrong, what you do about it, and how you show it is working.
- AssetsWhat you need to protect
- RisksWhat could go wrong, and how badly
- ControlsWhat you do about it
- EvidenceHow you show it is in place
- MonitoringHow you know it still is
Explore by task
- UnderstandLearn the security concepts, controls and frameworks behind the checks.
- AssessUse checklists and free tools to understand your current position.
- PrepareUse technical evidence and structured guidance for Cyber Essentials and ISO 27001 readiness.
- FixWork through practical remediation for a failed check or missing control.
Guided paths
Guided path
Secure a website and domain
Learn what your domain exposes, check each part of its public configuration, run the complete check and keep it under watch.
10 stepsDNSTLSHTTPEmailExternal security
- Security basicsGuide
- Understand your external attack surfaceGuide
- Check DNS configurationTool
- Check TLS and certificatesTool
- Check HTTP security headersTool
- Check email authenticationTool
- Review exposed servicesTool
- Run the complete Ironfang security checkIronfang Security
- Fix findingsReference
- Turn on continuous monitoringIronfang Security
Guided path
Prepare for Cyber Essentials
Understand the scheme and its five controls, work through the checklist, gather evidence and go to a certification body ready.
12 stepsCyber EssentialsUKReadiness
- Cyber Essentials overviewGuide
- Cyber Essentials requirementsGuide
- Define the assessment scopeGuide
- Review firewalls and internet gatewaysGuide
- Review secure configurationGuide
- Review security update managementGuide
- Review user access controlGuide
- Review malware protectionGuide
- Use the Cyber Essentials checklistChecklist
- Collect technical evidenceGuide
- Resolve remaining gapsChecklist
- Continue to the official assessment and certificationGuide
Guided path
Prepare for ISO 27001
Scope an ISMS, assess and treat its risks, choose controls, find the gaps and prepare for audit. Ironfang's checks support the technical controls only.
12 stepsISO 27001ISMSRisk managementReadiness
- ISO 27001 overviewGuide
- Define the ISMS scopeGuide
- Identify assets and interested partiesGuide
- Perform an information security risk assessmentGuide
- Define risk treatmentGuide
- Understand Annex A controlsGuide
- Build the Statement of ApplicabilityGuide
- Implement and document controlsGuide
- Perform a gap analysisGuide
- Collect evidenceGuide
- Prepare for internal audit and management reviewGuide
- Prepare for certificationGuide
Understand
Understand cyber security
The ideas and terms behind every check and framework, and the difference between the kinds of assessment.
- Cyber security basicsGuideAssets, threats, vulnerabilities, controls, risk and evidence, and how they fit together.
- External attack surfaceGuideWhat your organisation exposes to the internet, how to list it and how to shrink it.
- Security assessment vs auditGuideAn internal review, an automated check, a formal audit and a certification audit are different things.
- Vulnerability assessment vs penetration testGuideWhat each finds, what each does to your systems and when you need which.
Assess
Assess your security
Find out where you stand: a structured assessment, a working checklist and the complete check of a verified domain.
- Cyber security assessmentGuideThe kinds of assessment and a practical way to run one.
- Cyber security auditGuideWhat an audit is, how to prepare, and what automated technical evidence can and cannot support.
- Website security checklistChecklistA working checklist for a public website, with free checks where they help.
- External Security CheckIronfang SecurityEvery check on a domain you verify, exposed services included, with findings, evidence and a recheck.
Prepare
Security frameworks
Cyber Essentials and ISO 27001, explained practically. Ironfang's checks give technical evidence for some controls; certification is a separate, formal process.
- Cyber EssentialsGuideThe UK scheme, its five controls and how certification works.
- Cyber Essentials checklistChecklistWork through scope and the five controls before you apply.
- ISO 27001GuideThe ISMS standard, its clauses and Annex A, and the route to certification.
- Information security risk assessmentGuideIdentify, analyse and treat information security risks, the ISO 27001 way.
- ISO 27001 controlsGuideThe 93 Annex A controls in four themes, in plain English, and the Statement of Applicability.
- ISO 27001 checklistChecklistWork through clauses 4 to 10 and the Annex A themes before an audit.
Free tools
Free security tools
View all security toolsEach tool runs the same checks as Ironfang Security against one domain, at once and without an account.
- Website security checkerCheck a domain's DNS, email authentication, TLS, security headers and public technology in one pass.
- DMARC checkerLook up a domain's DMARC record, read its policy and reporting, and see what to change.
- SPF checkerCheck a domain's SPF record, its all mechanism and how many of the 10 DNS lookups it uses.
- SSL/TLS checkerCheck a site's HTTPS, certificate, expiry, TLS versions and weak cipher suites.
- DNSSEC checkerSee whether a domain's zone is signed, with a DS record at its parent.
- HTTP security headers checkerCheck a site's HSTS, CSP, framing, content-type, referrer and permissions headers.
- DNS security checkerCheck a domain's address records, nameserver redundancy, CAA, DNSSEC and dangling CNAMEs.
Fix
Fix security findings
Every Ironfang check has a reference page: what it looks at, the findings it can raise and the practical steps for correcting them. The guides explain the controls behind them.
- Security check referenceReferenceEvery check Ironfang runs and every finding it can raise, with the fix.
- DNS securityGuideNameservers, DNSSEC, CAA and dangling records.
- TLS and certificatesGuideProtocol versions, certificates, expiry and cipher suites.
- HTTP security headersGuideHSTS, CSP, framing, referrer and permissions headers, and cookies.
- Email authenticationGuideSPF, DKIM and DMARC, and how to move a domain to enforcement.
Monitor
Monitor your external security
A free tool answers what is true now. Ironfang Security keeps the evidence for your verified domains and checks them again, so you can see whether something changed, whether a fix worked and whether a problem came back.