Website security scan

Is your site really
safe?

A free security scan of your own website. No findings: free. Findings: you get a report with evidence and step-by-step fixes from €99. The fix service follows on request.

Only for sites you operate Confirmed in under a minute No sign-up until you get results

View the sample report (fictional data)

Three steps to your result

1

Submit your domain

You enter your website and tick the operator confirmation box.

2

Confirm the email

You receive a confirmation email and click the personal link. Only then do we start the scan.

3

Wait for the scan

Result in about 15 minutes. The basic report with traffic light and findings per severity is always free.

What we scan, concretely

Transport & server

  • TLS versions, weak ciphers, certificate chain & expiry
  • HSTS, http→https and www redirects
  • Security headers: CSP, X-Frame-Options, X-Content-Type-Options, Referrer- & Permissions-Policy
  • Cookie flags: Secure & SameSite

Publicly visible files

  • Debug & error logs, backup traces, SQL dumps, archives
  • Version disclosure: readme/license, generator tags
  • Directory listings

CMS attack surface

  • XML-RPC and friends as brute-force amplifiers
  • User enumeration via open REST APIs
  • Login page: is there any lockout?
  • Plugins & themes matched against all registered CVEs

Content & third parties

  • Mixed content over insecure http
  • Third-party scripts without integrity checks (SRI)

Mail infrastructure

  • SPF, DKIM & DMARC of your domain
  • Protection against spoofing in your company name

Visibility

  • Publicly reachable subdomains
  • Unknown or dead subdomains as doorways

What we do not scan, and why that is good for you

We deliberately stick to a pure external visual inspection, exactly what any attacker can see within minutes as well. Without loading your site. Without breaking the law.

You only pay when we find something

No findings = no cost. No findings also means: your outward-facing doors are closed, black on white.

Free scan

Scan & basic result

€0

Always free. So you know where you stand.

  • Traffic-light rating & score
  • Number of findings per severity
  • Rough categorisation
Scan for free
Deep-dive report with instructions

Full findings report

€99

Every finding with evidence link, plain-language explanation, risk assessment and fix guide.

  • All findings in detail
  • Fix guide for your host/developer
  • Free retest within 30 days
Request report
Stay covered with the subscription: a daily scan of your domain and an e-mail the moment anything changes. €39 per month in an annual plan with a 12-month term, cancellable monthly afterwards.
Pretty much done

Report + fix service

On request

Report plus a ready-to-execute work order. The effort is calculated individually for you after review.

  • Everything from the findings report
  • Fix work order incl. verification steps
  • Free retest within 30 days
Request a fix

Not sure what is inside? View the sample report (fictional data)

Start your free initial scan

Enter your domain, tick the box, get the result. No sign-up until you have your scan result.

We use your email address to occasionally send you information about your scans and about similar products, offers and services. You may object to this at any time, including the underlying profiling, for example by email to info@itsecurity.today.

Frequently asked questions

Is this legal?

Yes, exclusively for operators of their own websites: explicitly confirmed by the box you tick in the form and the link in your confirmation email, and with no deeper interference than a normal external visit of the page.

Will it slow my server down?

No. We contact your server at a maximum of one request per second. The full scan takes about 15 minutes.

What if my host cannot do something?

Every fix in the report names the host-specific variant: .htaccess rule, control-panel setting or plugin, including a copy-paste command.

Why pay only on findings?

Because we are convinced: something turns up almost every time. The free scan is simultaneously our proof of work.

Can I have it checked again after fixing?

Yes. A retest within 30 days of buying the report is free.