No fluff • No enterprise nonsense

Find real security issues before attackers do.

We run passive security checks and explain the findings in plain English — with clear fixes, not vague advice.

$ scanner check example.com
✓ TLS 1.3 negotiated, cert valid (54 days)
✗ No Content-Security-Policy header
✗ No Strict-Transport-Security header
! Port 8080 open to the internet
! Port 8443 open to the internet
done in 6.4s — risk score 42/100

What we look at

Just the things that actually matter. No fluff, no false positives.

HTTP security headers

Browsers expect specific headers to defend against script injection, clickjacking, and session theft. We check the standard set.

$ curl -I https://example.com
HTTP/2 200
content-type: text/html
strict-transport-security: ?
content-security-policy: ?

TLS / certificates

Cert validity, expiration, and which TLS versions you negotiate. Old protocols are a quiet but real risk.

$ scanner tls example.com
TLS 1.3 ✓
TLS 1.2 ✓
TLS 1.1 — outdated
cert expires in 54 days

Open ports

Anything beyond 80 and 443 is worth a look. Admin panels, databases, dev servers — these are the easiest wins for an attacker.

$ scanner ports example.com
22/tcp   ssh
80/tcp   http
443/tcp  https
8080/tcp http-alt — exposed

Here's what you'll get

A risk score, top issues with severity, and a step-by-step fix guide. Plain language, no jargon.

42/100

Domain

yourstartup.com

Open dev ports plus a complete absence of standard security headers — together a realistic path for a targeted attacker. TLS is solid.

Top issues

highDev ports 8080 and 8443 exposed to the internetports

highNo Content-Security-Policy headerheaders

mediumNo Strict-Transport-Security (HSTS) headerheaders

infoTLS certificate expires in 54 daystls

Each issue ships with a one-line attack scenario, business impact, and exact remediation steps you can paste into your config.

How it works

01
Enter your domain.
No signup, no credit card. Just type the URL.
02
We run passive scans.
Ports, headers, TLS. No exploitation, no auth probing — nothing that should worry your security team.
03
AI explains what to fix.
Plain-English business impact and step-by-step remediation, ranked by severity.

Pricing

Start free. Upgrade when you need monitoring or more depth.

Free

3 scans / week

Pro

$19/mo

10 scans / day · 5 monitored domains

Agency

$79/mo

Unlimited · 25 domains · API access

One-time · $29

Deep Audit — full report, emailed to you

Order →

Compare all plans →

Common questions

Is this safe to run? Will you break anything?+

Yes, safe. We run only passive checks: looking up open ports, fetching public headers, inspecting your TLS handshake. We don't probe authentication, send malicious payloads, or generate volumetric traffic. The footprint is similar to a normal browser visit plus a port scan.

What's the difference between the free scan and Deep Audit?+

The free scan gives you a risk score and the top 5 issues with fixes. The Deep Audit ($29 one-time) includes an executive summary, business-impact narrative, up to 10 ranked issues, a remediation playbook, and compliance notes — emailed to you with a permanent share link.

Do I need to own the domain I'm scanning?+

Not for the free scan or Deep Audit — we only do passive checks, similar to what any visitor's browser already sees. We'll require domain ownership verification later for monitoring (recurring scans + alerts), since that's a longer-term relationship.

What happens to my scan results?+

Free scans are stored against your account if signed in. Public report links use unguessable random IDs — only people you share them with can find them. We never sell data, never share with third parties, and you can request deletion any time.

Can I cancel anytime?+

Yes. Subscriptions cancel at the end of the billing period — you keep access until then. One-time Deep Audits are yours to keep forever once delivered.

Ready to see what's actually broken?

Free scan. About 30 seconds. No signup.

Scan your site See pricing