Check a website
We make a DNS lookup, three standard TLS handshakes (one normal, one testing old TLS versions, one testing post-quantum key exchange) and one page request to port 443. We don't store or log the domain or the results, and we don't follow redirects. Our hosting provider, Netlify, keeps short-lived technical logs and uses your IP address to apply the limit of 10 checks per minute.
What it checks
- Post-quantum key exchange. Whether the server accepts the hybrid
X25519MLKEM768group, which pairs classical X25519 with ML-KEM-768 from NIST FIPS 203.1,2 Without it, traffic recorded today could be decrypted by a future quantum computer.3 The NCSC asks organisations to plan this migration now.7 - TLS version and cipher, and whether deprecated TLS 1.0 and 1.1 are still accepted.4
- Certificate: key type and size, issuer, expiry date and whether browsers trust it.
- Visible software versions in response headers, including PHP versions affected by PHP2Shell and versions past end of life.5
- HSTS, which stops later visits being downgraded to plain HTTP; preloading also protects the first visit.6
What it does not check
- More than one server: if the domain has several addresses, we check the first IPv4 address only.
- Other subdomains, mail servers, VPNs, APIs on other ports, or anything inside your network.
- Flaws in your application code. We never try to exploit, log in or guess anything.
- Which key exchange your visitors actually get: that also depends on their browser.
- Your PHP version, unless the server announces it. Hiding it is good practice, so "not shown" is not proof you are patched.
For a full inventory across your systems, including internal ones, that is what Aki Horizon is for.
Sources
- IETF: Post-quantum hybrid ECDHE-MLKEM key agreement for TLS 1.3
- NIST FIPS 203: Module-Lattice-Based Key-Encapsulation Mechanism Standard
- Aki Labs: Harvest now, decrypt later (with sources)
- RFC 8996: Deprecating TLS 1.0 and TLS 1.1
- Aki Labs PHP2Shell advisory, citing the PHP security release of 21 Oct 2026 and PHP: Supported versions
- RFC 6797: HTTP Strict Transport Security (section 14.6 covers the first visit)
- NCSC: Timelines for migration to post-quantum cryptography