How well the website is protected
Whether the connection is properly secured, whether the platform and its components are out of date, and whether service files are open to outsiders.
Check your website for vulnerabilities
Check the work of a freelancer you don’t know, or of an agency that promised you and your users complete security. The report shows facts instead of promises: what is set up correctly and what your developer needs to fix.
A free check with no sign-up, the full one in paid plans. Connection security, leaks, outdated components, signs of a hack, injections, malware and load. A repeat check shows what was fixed, and after it the website can be put on 24/7 monitoring.
- 1. Website
- 2. Access
- 3. Report
Free check
No sign-up. We look at the home page the way any visitor sees it.
Up to 5 free checks an hour. The full check is in the paid plans.
Sample with made-up data. No website was checked.
Check results
“Needs attention” is a setting to review with your developer, not a proven way to break in. Look at these items first, then at the areas that were not checked.
What to fix first
Up to five findings ordered by risk. Confirm them with your developer; unchecked areas are listed below.
Compared with the previous check
This was the free check
It only looks at the home page. The full check confirms access to the website and finds what cannot be seen from outside:
- crawls and analyses the website’s pages;
- looks for forgotten service files and settings;
- checks server software for known vulnerabilities;
- looks for malicious code in pages and scripts;
- optionally, injections and behaviour under load;
- compares the result with the previous check.
Check by hand
What the check did not cover
In the private beta, reports are kept for 24 hours. Download yours if you will need it later. A repeat check shows what was fixed since the previous one.
What you will learn
Whether there are signs of a hack
Whether the pages carry hidden links to other websites, and whether search engines and browsers consider the website dangerous.
What to fix, and in what order
A report for your developer with advice on every item, a list of what to check by hand, and a comparison with the previous check.
What the service checks
We look at your website the way an attacker would, but carefully and only with your permission. Every item in the report explains what was found, why it is dangerous and how to fix it.
Connection security
always- Encryption and certificate authenticity
- Enforced secure connection
- Certificate validity
- Outdated encryption protocol versions
Security settings
always- Protection against page tampering and embedding
- Cookie and session security
- Data leaks through headers and caching
- Insecure resources and forms on the page
Leaks and forgotten files
always- Exposed service files and settings
- Technical details that help attackers
- Errors visible to visitors
Outdated components
always- The website platform and software versions visible from outside
- Connected libraries with known vulnerabilities
- What to update first
Signs of a hack; reputation when sources are connected
always- Hidden links to other websites, a common trace of a hack
- Spam inserted into pages
- Danger flags from search engines and browsers
Injections and attacks
optional- SQL injection
- Cross-site scripting (XSS)
- Attacks through page addresses and parameters
Known vulnerabilities and malware
always- Server software checked for known vulnerabilities
- Malicious code in pages and scripts
Load
optional- How the website responds under load
- Response speed and errors
- Gentle mode: the check stops itself if something goes wrong
After the check
in every report- Comparison with the previous check: what was fixed and what is new
- A list of what to check by hand
- A report for your developer: file, copy, PDF
Pricing
Start with the free check. The full check confirms access to the website and goes deeper: it crawls pages and looks for forgotten files, known vulnerabilities, malicious code and injections.
Free
€0
The home page as a visitor sees it
- HTTPS and encryption
- Security settings
- Platform and outdated libraries
- Signs of a hack; reputation when sources are connected
One-off checks
- 1 check€0.99
- 5 checks€4.49−10%
- 20 checks€14.90−25%
For any of your websites, never expire. One check covers up to 20 pages; a larger website uses one check per 20 pages
- Everything in the free check
- Crawling and forgotten files
- Known vulnerabilities and malicious code
- Injections and load, optional
- Comparison with the previous check
Subscription
- 1 website€14.90/month
- 2–5 websites€24.90/month
- 6–10 websites€32.90/month
Everything, for your websites
- Unlimited full checks
- Comparison and check history
- Reports for your developer
| Free | One-off | Subscription | |
|---|---|---|---|
| Connection security and encryption | ✓included | ✓included | ✓included |
| Security settings | ✓included | ✓included | ✓included |
| Platform and outdated libraries | home page | whole website | whole website |
| Signs of a hack; reputation when sources are connected | ✓included | ✓included | ✓included |
| Crawling and page analysis | —not included | ✓included | ✓included |
| Forgotten service files | —not included | ✓included | ✓included |
| Known server software vulnerabilities | —not included | ✓included | ✓included |
| Malicious code | —not included | ✓included | ✓included |
| Injections and load | —not included | optional | optional |
| Comparison with the previous check | —not included | ✓included | ✓included |
| Number of checks | 5 an hour | per pack | unlimited |
Online payment is being connected. Until then we take orders by hand: press a plan button and send us your website’s domain.
Monitoring after the check
A check shows the state of your website today. Monitoring watches it around the clock and tells you about a problem before your customers notice.
The website is down
We check the website every minute. If it stops opening, you get a message with the reason right away, and another one with the downtime when it is back.
The website slowed down
We know how fast your website normally responds and warn you when it slows down noticeably. This is often the first sign of overload or a bot attack.
The certificate expires soon
We remind you to renew the certificate in advance, so browsers do not start scaring visitors with a warning.
Alerts in Telegram and by email
Urgent alerts go to Telegram, summaries and warnings by email. Several events in a row arrive as one message.
Status page
A private link for the website owner: uptime, speed and outage history on one screen.
Weekly summary
Every Monday, a short email about how the website worked during the week.
Monitoring is connected separately and is not included in a scan subscription. For availability and setup, get in touch.
Before you start
Is this a penetration test?
The service checks the settings and looks for leaks, outdated components and signs of a hack. A full check always looks for known vulnerabilities and malware; you can also turn on checks for injections and attacks and for load. The report shows exactly what was checked. No scanner can find absolutely every vulnerability, and we do not promise that.
What does the service do to my website?
It opens the website’s pages like an ordinary visitor and checks the settings. The domain’s reputation is checked against open sources, and only its name is shared. Active checks send special requests only with your consent. The service never signs in to accounts, and passwords, cookies and secret keys never appear in the report.
Why does the full check need access confirmation?
The free check only looks at what any visitor sees, so no confirmation is needed. The full check goes deeper, so we run it only for websites you manage. Ask your developer to upload the file: no changes to the website’s pages are needed.
How is monitoring different from a check?
A check looks for vulnerabilities and gives you a report. Monitoring runs all the time and tells you if the website is down, slow or its certificate is about to expire.
Can I get a security guarantee?
No. Even a clean result for these settings does not rule out vulnerabilities in the website’s code, access controls and business logic.