Is this website soundly built?
Enter an address. We measure what can be measured from the outside, and show you every step of it.
Free, in full, and the first check needs no account.
You cannot tell from looking at a website whether somebody who knew what they were doing built it. The design says nothing about that. Neither do the promises. What does say something are the traces the building leaves behind — and those can be measured.
Eight areas, all measurable from outside
Every statement is a measurement with evidence. What we could not measure, we say — and it counts neither for nor against.
Encryption
Who issued the certificate, how long it is still valid, whether it matches the address — and whether outdated protocols are still on offer. Plus: does plain http actually take you to https?
What the server announces
HSTS, Content-Security-Policy, frame protection, referrer policy. And whether the server volunteers its version number — which mainly interests somebody looking for a matching hole.
Where it runs
Addresses, name servers, the provider behind them. Plus the mail records: without SPF and DMARC anybody can write in the domain's name.
How long it has existed
The registration date, as far as the registry publishes one — for .de it does not. The certificate history then stands in: since when the domain has demonstrably been served.
Craft
Notes left behind in the source, emoji in the markup, compression, image weight, language attribute, heading structure. Small things, but they add up to an impression.
What lies open
A served .git directory, a reachable .env, an open directory listing. We compare against a control address, so a site that answers everything is not accused of publishing anything.
Required disclosures
Whether the imprint and privacy policy are linked and reachable, and which parts are on them. We name what is missing — whether it satisfies the law is not for this page to decide.
Findability
robots.txt, sitemap, a published security contact. Whoever wants to be reachable makes themselves reachable.
One to a hundred, and what lies between
Each area starts at full marks and findings take points off. A few serious ones put a lid on the total, however good the rest is.
A service we could not reach lowers the achievable total with it — it can never make a website look worse.
Limits
What this check is not
You are seeing a snapshot from the outside. That is useful, and it is limited.
Not a penetration test
We fetch publicly reachable addresses and read what comes back. We sign in nowhere, change nothing and try no exploits.
Not an audit
An ISO 27001 or BSI certification examines processes, contracts and people. This page sees none of that.
Not legal advice
We establish whether an imprint is linked and which details appear on it. Whether it meets the requirements is for a lawyer, not software.
Not a statement about the company
A carefully built website does not necessarily belong to a careful company. And the other way round.
The result describes the technical state of a publicly reachable website at the time of measurement. It contains no assessment of the provider behind it and is not legal, security or investment advice.
Put the result on your own site
The check is and stays free. Anyone who wants to show the result gets a seal and a report.
Artim Industries
Trust Center
09/2026
€20per website · plus VAT
- A badge to embed, with month, year and score
- A PDF with every single finding and its evidence
- Issued for the domain, not for one page
We only issue a seal for domains you control — we ask about that first.
We also build websites that pass a check like this
If you do not like the result for your own site: it can be fixed, usually faster than you would think.