Scan your website’s security for free

Three things on the page you submit. The HTTP security headers your server sends: Content-Security-Policy, HSTS, X-Frame-Options, cookie flags, Referrer-Policy and X-Content-Type-Options. The TLS setup: the protocol in use and the certificate, including when it expires. And the JavaScript that runs on the page: we load it in a real browser, capture every external and inline script the page itself runs, name the vendor where we recognize it, and read the code. A script is flagged when it behaves like a skimmer, loads from a host on a current malware blocklist, sits on a look-alike domain, or runs a library version with a published vulnerability. A vendor we do not recognize is listed as a third-party script and is not flagged for that alone, because an unfamiliar name is not evidence. You get an A+ to F Security Score, a grade for each of the three areas, and the list of scripts we found.

Yes. There is no account to create and no card to enter. You give us the page and an email address, we run the scan and send the full report to that address. If you then want continuous monitoring, that is free during the open beta as well.

We keep the scan result, the email address you enter and a pseudonymized record of your IP address and browser, so we can send you the report and, now and then, security tips and product updates. Every email has an unsubscribe link. The scan record is deleted after 90 days. Your address stays on our list until you unsubscribe. The scan reads the public page the way any visitor’s browser would. We collect no credentials and change nothing on your site.

The scan still runs, and a firewall often lets it through. If the firewall turns our anonymous scan away, the report says so and shows what we could confirm from the outside, such as the TLS setup. We recognize the challenge pages of the bot-protection services we know and never grade one as if it were your site. For continuous monitoring, your dashboard gives you the allow-list rule for your firewall. No code is added to your site.

A one-time scan tells you the state of your headers, TLS and scripts right now. Client-side attacks work through change: a trusted third-party script silently swapped, or a new script appearing on your checkout after a compromise. During the open beta, continuous monitoring scans checkout, cart, login and account pages every four hours and every other monitored page once a day, compares each result with the approved baseline of script hashes and, after the site’s first week, emails you when a scan finds a change worth your attention. During the first week only critical findings are emailed. Routine vendor updates are recognized and filtered out.

Headers and TLS can be read from the server’s response. The scripts that actually run, including ones that other scripts add after the page loads, only show up when the page is rendered the way a visitor’s browser renders it. So we load the page in a real browser, capture every script the page itself runs, and compute a hash of each one. The inventory then shows what your visitors receive, which the raw HTML alone would not.