Website security scans
Find the security gaps in your website.
Enter your site or server. After you prove it is yours, we scan it safely and show you what to fix.
- Only sites you own
- Approved by a person
- Never exploits anything
How it works
Three steps to your report.
Enter your address
A website or a public server IP.
Prove it is yours
Add a DNS record or a small file. A person then approves the scan.
Get your report
Findings ranked by risk, each with a clear fix.
What we check
Six areas we look at.
TLS and headers
Certificates, HSTS, CSP and cookie settings.
Email security and phishing
SPF, DKIM, DMARC and lookalike domains.
Exposed files and panels
Admin pages, backups and leaked secrets.
Application weaknesses
Injection, XSS and redirect signals, never exploited.
Database and storage exposure
Open databases, storage buckets and public data APIs.
Outdated components
Old servers, libraries and plugins with known issues.
What you get
A report you can act on.
Every finding shows the evidence and the fix, highest risk first.
- HighAdmin panel reachable from the internet
FixLimit /admin to your office IP, or put it behind single sign-on.
- MediumContent Security Policy is missing
- LowDMARC policy is set to none
Pricing
Pick how deep and how often.
Starter
A first look at one site or server.
$20one time
- 1 light scan
- Light scan depth
- TLS, headers and email security
- Obvious exposed files and panels
Pro
RecommendedRegular, thorough checks for a team that ships.
$100per month
- 2 comprehensive scans a month
- Comprehensive scan depth
- Everything in Starter
- Full exposure, app weaknesses and databases
Business
Everything we can safely look at, as often as you need it.
$500per month
- 5 full scans a month
- Full scan depth
- Everything in Pro
- Components, deeper discovery and lookalike domains
Prices in US dollars. You pay after creating your account. Every scan still needs proven ownership and approval.
Safety
What we never do.
- Exploit a weakness
- Read or change your data
- Slow down or take down your site
Every scan needs proven ownership and a person's approval.
FAQ
Common questions.
Can I scan a site I do not own?
No. You prove control with a DNS record or a file, and a person approves every scan.
Does typing an address here start a scan?
No. It only carries the address into your new account. Nothing is contacted before approval.
Is it safe for my live site?
Yes. We only read what your site already shows the public. No attacks, no data access, no heavy traffic.
How do the packages differ?
In how deep each scan looks and how many scans you get. The safety steps are the same in every package.
Is AI involved?
Yes. It helps analyse results and write the fixes. It never decides ownership and never approves a scan.