Know exactly how attackable your domain is.
A security audit of your website, email and servers that shows its work: every finding comes with the raw evidence, why it matters for your business, and the exact configuration to fix it.
Seven areas attackers actually use
The same things automated attack tools look for in the first minutes after a site goes online - checked from the outside, the way an attacker sees you.
Web security 18 checks
Security headers, HTTPS enforcement, cookies and cross-origin rules of the website.
- Site is served over HTTPS
- HTTP redirects to HTTPS
- HSTS enabled with a long lifetime
- Content-Security-Policy restricts scripts
Data exposure 29 checks
Configuration files, backups and source code that should never be public.
- Directory listing disabled
- Debug error pages turned off
- No public CMS debug log
- No public /.git/HEAD
TLS & certificates 9 checks
Certificate validity and trust, key strength and protocol versions.
- Certificate within its validity period
- Certificate valid for 30+ more days
- Certificate covers the host name
- Certificate chain trusted by browsers
Email security 12 checks
SPF, DMARC, DKIM, MTA-STS: protection against spoofed mail in your name.
- SPF record published
- SPF rejects unlisted senders
- SPF within the 10-lookup limit
- SPF avoids the deprecated ptr mechanism
Network & services 16 checks
Databases, remote access and other services reachable from the internet; blocklist status.
- No plaintext FTP
- Not on spam or malware blocklists
- telnet (23) not exposed
- smb (445) not exposed
DNS & attack surface 7 checks
DNS hygiene, subdomains, takeover risks and domain registration.
- CAA record restricts certificate issuance
- Zone transfers refused (AXFR)
- DNSSEC enabled
- Domain registration valid for 30+ days
Known vulnerabilities 6 checks
Published CVEs affecting the software versions your servers reveal.
- No WordPress plugins or themes with known vulnerabilities
- WordPress plugins and themes maintained and up to date
- No known CVEs in disclosed software versions
- No actively exploited vulnerabilities (CISA KEV)
Every check, documented
See the full list of 97 checks, what each one looks for and why it matters.
Browse all checksNot a list of warnings. A plan.
Built for the person who has to fix things - and for the person who has to decide.
Score, grade and executive summary
A 0-100 score with an A-F grade, points lost per area, and a plain-language summary you can forward to management.
Prioritized action plan
Issues sorted into fix now, fix this month and hardening, with an effort estimate and the quick wins called out.
Copy-paste fixes
Step-by-step instructions with ready configuration for nginx, Apache, DNS and common platforms.
Evidence for every finding
The header, record, banner or file that proves it - so your team can verify instead of arguing.
Monitoring between scans
We re-check the software found on your domains every day against new CVEs, actively exploited vulnerabilities and vendor releases - and alert you on your dashboard.
PDF for clients and auditors
Print or save the full report as a clean PDF - for a customer, an insurer or a compliance file.
Try a free instant check
Four of our tools are free for any domain, right now.
Three steps, five minutes
Create an account
E-mail and password. Your first scan is free.
Verify your domain
Add a DNS TXT record or upload a small file. This keeps anyone from scanning domains that are not theirs.
Get your report
The scan takes about a minute. Fix the issues and scan again to watch the score rise.
See the problems for free. Get the fixes with a credit.
| What you get | Free scan | Full report |
|---|---|---|
| Security score, grade and executive summary | ||
| Points lost per security area | ||
| Every finding with title and severity | ||
| Complete evidence and fix for your most urgent finding | ||
| Prioritized action plan | ||
| Evidence proving each finding | — | |
| Why it matters - business impact | — | |
| Step-by-step fix with configuration snippets | — | |
| Passed checks and comparison with the last scan | ||
| Daily monitoring for new vulnerabilities | ||
| Printable PDF report |
Pay per scan. No subscription.
Credits never expire. One credit = one full report.
- Security score and grade
- Executive summary and action plan
- All findings with severity
- Full fix for your most urgent finding
- Daily monitoring and alerts
- Evidence and fixes for all findings
- Everything in Free
- Evidence for every finding
- Business impact and step-by-step fixes
- Copy-paste configuration snippets
- Credits never expire
Save 20%
- Everything in Free
- Evidence for every finding
- Business impact and step-by-step fixes
- Copy-paste configuration snippets
- Re-scan after fixing to track progress
- Credits never expire
Save 33%
- Everything in Free
- Evidence for every finding
- Business impact and step-by-step fixes
- Copy-paste configuration snippets
- Re-scan after fixing to track progress
- Ideal for agencies with many client domains
- Credits never expire
Thorough, and read-only
Read-only
We look at what your servers already show the internet. Nothing is exploited, brute-forced or fuzzed: every request is one a browser or a search engine would send.
Ownership-verified
Scans run only against domains you prove you control, so nobody can use the service against you.
Private by default
Reports are visible to your account only. Secrets we come across are redacted in the report.
No false confidence
Findings inferred from version numbers are marked "needs confirmation", never presented as fact.
Questions, answered
Is it legal to scan my domain with this?
Yes, for domains you own or are authorized to test. That is why every scan requires proof of control over the domain (a DNS record or a file on the web server). The scan is read-only and comparable to what search engines and browsers already do.
Can the scan break my website or slow it down?
No. It sends ordinary GET requests - at most 25 pages of the site, a fixed list of well-known paths and the public files of the plugins in use - completes a handful of TLS handshakes and connects once to 28 common ports. Nothing is exploited, no passwords are tried and no forms are submitted.
Does it catch newly published vulnerabilities?
Yes. Every scan checks the live NVD vulnerability database and CISA's catalog of vulnerabilities exploited in real attacks, and compares your software with the vendors' latest releases. A missing security patch is flagged the day the vendor ships it - even before the CVE database lists which versions are affected.
Do I find out about new vulnerabilities between scans?
Yes. Every day we compare the software versions found at your last scan with new CVEs, CISA's list of actively exploited vulnerabilities and vendor releases, and check the certificate, the domain registration and the SPF and DMARC records. Anything new appears as an alert on your dashboard with a one-click rescan. The only connection to your server is one TLS handshake to read the certificate.
How is this different from a penetration test?
A penetration test is a manual engagement where experts actively try to break in, typically over days. This is an automated, external audit of your configuration and exposure: it finds the issues attackers' tools find first, in a minute, at a fraction of the price. Many teams scan after every change and buy a penetration test once a year.
How do I verify my domain?
After adding the domain you get a token. Publish it either as a DNS TXT record or as a small text file on your web server, then click Verify. It usually takes two minutes.
What is in the free scan?
The full scan, with your score, grade, executive summary, action plan and every finding's title and severity - plus the complete evidence and fix for your most serious finding. The evidence and fixes of the other findings are unlocked with one credit.
Are CVE findings certain?
They are matched on the software version your server reveals, against the official NVD database. Linux distributions often backport fixes without changing the version number, so these findings are marked "needs confirmation" and count half in the score.
Do credits expire? Can I scan subdomains?
Credits never expire. A verified domain covers all of its subdomains, so you can scan www, shop, api and every other host under it.
Who can see my reports?
Only your account. Secrets found in exposed files are redacted before the report is stored.
Find out before someone else does.
Your first scan is free. It takes about a minute.
Scan your domain