Free cybersecurity tools for startups.

A few situations this page is for. You bought a new domain and want to make sure browsers and email providers aren't flagging it as suspicious. A customer or team member sent you a weird URL or email and you need to know whether it's phishing without clicking it. You've confirmed someone is impersonating your brand and need to report it. Or none of that has happened yet and you want your first few hires to have a trained eye before it does.

If you're in the middle of an active incident affecting customer data, this is not your first stop. Open your incident response playbook first.

Check your own domain.

Run these in order. Five minutes the day you buy a domain, fifteen minutes once a quarter after that.

1. urlscan.io

   Paste your domain. Get back a screenshot of what your site looks like to an outside browser, the chain of redirects, and any suspicious activity. The primary tool for this category.

   If urlscan.io is slow or unavailable, urlquery.net does the same job as a backup.

2. VirusTotal

   Paste the URL. Checks against roughly seventy blocklists from antivirus vendors, browser safety services, and threat intelligence providers in one shot. If you're flagged by any of these, you need to know which one and why.

3. Google Safe Browsing

   The single most important one to pass. If you're flagged here, Chrome shows a full-page red warning to anyone visiting your site. Firefox, Android, and Google Search use the same list. Pass this one or your traffic dies.

4. MxToolbox Domain Health

   Checks your domain against more than a hundred email and web blacklists, plus DNS and mail server configuration. This catches a different failure mode than the tools above: your site can look completely clean in a browser while your outgoing email quietly lands in everyone's spam folder. Worth a look the same day you set up your first transactional email.

If anything turns up flagged, the fix is usually requesting re-evaluation from the specific service that flagged you. Each tool above points to the relevant request page from its results screen.

Triage a suspicious URL.

Someone sent you a link or attachment and you're not sure. Do not click. Run these instead.

1. urlscan.io

   Same tool as above, different mode. Paste the suspect link, get a sandbox screenshot and the full request chain. You see what the page looks like without visiting it from your laptop.

   If urlscan.io is slow or unavailable, urlquery.net does the same job as a backup.

2. VirusTotal

   Paste the URL or upload the file. Tells you if any of the major threat-intelligence providers have flagged it. Strong "is this already known to be bad" signal.

3. CheckPhish.ai

   Specifically tuned for phishing detection. A useful second opinion when VirusTotal is ambiguous; sometimes catches things the antivirus-vendor consensus misses.

4. any.run power tool

   Interactive remote sandbox for files and URLs. Use this when you actually need to watch what a suspicious file does, not just whether it's flagged. Free tier is enough for occasional use; a real founder need maybe twice a year.

5. MxToolbox Email Header Analyzer

   Paste the raw headers from a suspicious email and see the real delivery path, plus whether SPF, DKIM, and DMARC passed. Often the fastest way to confirm a phishing email before you touch the link inside it: if the headers show it didn't come from where it claims, you're done.

Report a phishing site impersonating your brand.

If you've confirmed someone is phishing using your brand name or domain, three reports do most of the work. Ten minutes total.

1. Google Safe Browsing

   Most impactful single action. Blocks the page in Chrome, Firefox, Android, and Google Search results. Submit this one first.

2. Microsoft SmartScreen

   Blocks the page in Edge and across Office 365 (so suspicious URLs in Outlook get warned about). The second-most-impactful single action.

3. APWG

   Anti-Phishing Working Group. Feeds the industry-wide anti-phishing database that powers many filtering products downstream of the big three browsers. Worth ten extra minutes.

A longer list exists. Forty different services accept phishing reports. The marginal value beyond these three is small for the time it takes, so we don't list them. If you're hit by a sustained impersonation campaign, an incident response firm has the full workflow and the relationships to make reports stick.

Train yourself and your team.

The tools above help you check something specific. This is different: a few minutes spent training your own eye, and your first hires', pays off before you ever need the tools above.

1. Google Phishing Quiz

   Eight real examples, phishing or not. Built by Google's Jigsaw team. Takes about five minutes; send it to your first few hires as well as taking it yourself.

2. Spot the Phish

   Four emails, same idea, from Terranova Security. A second opinion in a different format; some people's eye catches things faster one way than the other.