Free website security scannerWho finds it first?You, or the attacker?
Scan your site for free, see the gaps in one scorecard, then keep it monitored with a free account.
anadolu-lojistik.example
60/100 · Weak · average of 4 tests
Fix this first · Security headers test
- Security headers testF
- SSL/TLS checkA
- Email securityF
- Attack surface scanA
Fictional domain; laid out like the real report.
Check for yourself.
Pages where you can verify what we say without asking us.
Open data
410,762 records
Our scanner bots
Status page
Responsible disclosure
Start free.
The tools work without an account. A free account watches your site and tells you when something changes. Deep scans and daily monitoring come with Pro.
Free tools
8 tests, plus a security scorecard that runs 4 of them together and gives one grade.
No account needed: 3 scans a day.
CVE database
410,762 records
One action score per vulnerability: how severe (CVSS), exploited in the wild (CISA KEV), how likely to be exploited (EPSS). With the fixed version when one exists.
WP Lens
WordPress scanner
Matches plugin, theme and core versions against CVE records; flags closed plugins and those with no fix released.
Light scan without an account; deep scan on paid plans, after you confirm you are authorized.
Port scan
Finds open ports and service versions and matches them against known vulnerabilities.
Works without an account: 3 scans a day. Only on systems you are authorized to test.
Uptime monitoring
Tells you when your site goes down, before its certificate expires, and when its IP address or Cloudflare setup changes.
Free account: 1 site, checked every 30 minutes. Pro: 20 sites, as often as every 5 minutes.
Monitoring products:Uptime monitoringAttack surface monitoringCVE alerts
An agency looking after client websites? Deliver the report under your own brand.For agencies
Plans
No account
Tools, scorecard and WP Lens: 3 scans a day in total. Port scan: 3 a day.
Free account$0
1 site: rescanned weekly, an email if it goes down. Alerts when software you run gets a vulnerability. 10 scans an hour.
Pro$29/mo
20 sites: rescanned in the daily scan, uptime checked as often as every 5 minutes. Deep scans, after you confirm you are authorized. Vulnerability alerts every 10 minutes. No auto-renewal.
Where the tools stop, our team starts.
Automated scans read the public surface. We find broken access control, business logic flaws and chained vulnerabilities by testing by hand.
Four steps. No surprises.
Timeline, communication and deliverables in writing from day one.
- 011–2 days
Scope
Targets, testing window, communication channel and emergency protocol are agreed in writing.
- 025–15 business days
Testing
Primarily manual testing. If we find something critical, we don’t wait for the report: you hear the same day.
- 033 days
Report
Executive summary and technical appendix, plus a finding-by-finding session with your developers.
- 04Within 30 days
Verification
Fixed findings are retested free of charge. The closing report is audit-ready.
Free mini assessment
We review your external attack surface within 2 business days and summarize the top risks on a single page. No commitment.
- 01Leave your email and domain.
- 02We review your external surface within two business days.
- 03You get a one-page summary and a recommended first step.
- 14
- Subdomains
- 6
- Exposed services
- B
- TLS grade
- 3 / 7
- Security headers
Top three risks
- 1Admin panel exposed to the internetHigh
- 2Outdated TLS version still supportedMedium
- 3Content Security Policy missingLow