SecAudit seal verifier
Enter a domain to check its SecAudit seal. Your browser verifies the digital signature of the seal record, the date of the last audit and the owner’s DNS confirmation.
The domain you enter is sent to secaudit.eu to fetch its seal record and to Cloudflare DNS to look up the opt-in record. The signature is checked in your browser.
What a SecAudit seal means
SecAudit is AngelForce’s security audit plugin for WordPress. Sites that score well can show a “SecAudit verified” seal that links to a public score page on secaudit.eu. The score is real and time-stamped: when it drops or the audit becomes too old, the seal is downgraded or disappears.
How the verification works
A seal image can be copied, so this page checks the source instead. It fetches the seal record for the domain from secaudit.eu and verifies its Ed25519 digital signature in your browser against SecAudit keys built into this page. An edited record, a record for another domain or an expired one does not pass.
Site owners can also publish a DNS record, _secaudit followed by their domain, that names their seal. The verifier looks it up through Cloudflare DNS and shows whether it matches. The record format is published, so anyone can build their own verifier.
Questions
Why is a seal image on a website not enough?
Anyone can copy an image. Only the signed record on secaudit.eu, checked here, shows that the site was really audited and when.
Why does a site show “no seal found”?
Either the site has no SecAudit seal, its last audit is too old, or its score no longer meets the requirements. SecAudit is launching soon, so until then no site has a published seal; use the Example button to see a verified record.
What is the DNS confirmation?
An optional TXT record, _secaudit followed by the domain, with the value v=SA1; id= and the seal ID. It shows that the domain owner enabled the seal. A record that names a different seal makes the verification fail.
Does the verifier contact the website itself?
No. It only contacts secaudit.eu for the seal record and Cloudflare DNS for the TXT record. The domain you enter is sent to both.
Need more than a tool can show?
A tool checks one thing. Our consultants look at the whole picture.
Secure softwareRelated articles
-
A practical WordPress security checklist
Twelve WordPress hardening steps in a sensible order, from updates and abandoned plugins to 2FA, XML-RPC, backups, file integrity and a WAF.
-
Security headers that matter, and the ones to retire
A practical guide to CSP with nonces, HSTS and preload, frame-ancestors, Referrer-Policy, Permissions-Policy and COOP, with examples and what to drop.
-
How to design and test secure file uploads
A checklist of controls for file upload features, based on the OWASP cheat sheet, with a table of tests to run against each upload endpoint.