FOR SMALL BUSINESSES AND FOUNDERS
A free security badge for your website
Liaison checks your website from outside every week, the way any visitor’s browser sees it. If it passes, you get a badge for your site. Your clients click it and read, in plain words, what was checked and what it means for them.
- Enter your website and your work email below.
- Click the link we email you. If your email is at your website’s domain, that is the proof the site is yours. Nothing to set up.
- Within the hour, Liaison emails you the result: your badge and the code to paste (where to paste it), or a short list of what to fix first.
Ask for the badge
What the badge checks
- HTTPS. The site is encrypted, and http:// sends visitors to https://.
- HSTS. Browsers are told to always use the encrypted version.
- Exposed files. No code, passwords or backups (.git, .env, backup.zip and similar) can be downloaded from the site.
- Email spoofing. SPF and DMARC records stop others sending email in your name.
- Security headers. Content-Security-Policy, nosniff, frame protection and Referrer-Policy.
- Cookies. Sent over HTTPS only, with SameSite, and login cookies hidden from page scripts.
- Mixed content. Nothing on the home page loads over plain http://.
- Outside scripts. Scripts from other sites carry an integrity fingerprint.
- Version banners. The server doesn’t announce which software versions it runs.
- Folder listings. Folders like /uploads/ don’t list their files.
- Certificate. More than two weeks left before it expires.
- Encryption version. Only TLS 1.2 or newer is accepted.
- Database ports. MySQL, PostgreSQL, MongoDB, Redis, Elasticsearch and remote desktop don’t answer from the internet.
- security.txt. A published contact for reporting security problems.
- DNSSEC. The site’s DNS answers are signed.
- CAA. A DNS record names who may issue its certificates.
- Mail encryption. MTA-STS and TLS reporting are set up, and the mail servers offer STARTTLS.
- Domain. Registered for more than 30 days ahead.
- WordPress. The current version, if the site runs it.
The first three are needed for the badge. Every other one that passes adds a tick on your badge’s page.
What the badge is
It says that on a given date your site passed the checks above, and it is re-checked every week. If the site stops passing, we email you first, and after three failed checks in a row the badge turns grey by itself. It can’t be copied to another site, because it shows your domain and its page lives on liaison.vision.
Why put it on your site
A visitor who has never heard of your business decides in a few seconds whether to type a card number or an address into your site. The badge gives them something to check before they do.
MORE LIKELY TO TRUST A SITE THAT SHOWS A THIRD-PARTY VERIFIED BADGE
The opposite costs sales. One online shopper in five has walked away from a checkout because they didn’t trust the site with their card.
WHY SHOPPERS LEFT A CHECKOUT
Bigger clients check their suppliers now, because more attacks come in through one. A weekly check anyone can open is an answer to have ready when a client asks how you handle security.
BREACHES THAT CAME IN THROUGH A SUPPLIER OR PARTNER
Ask for the badge. It’s free.