Free while in beta · No sign-up
Find the security problems on your website
A free, read-only check for outdated software, exposed files, leaked keys and weak settings. You get a plain-English report with fixes you can hand to your developer.
Safe on a live site: we only read what your site shows the public. Pages behind a login and code on your server aren't visible to any outside scan.
How it works
Three steps. Most audits finish in under a minute.
-
1
Enter your domain
Tell us which site to check, and confirm it's yours or that you have permission to test it.
-
2
We look around, carefully
We visit your pages the way a normal visitor would, read the scripts they load and check about 20 well-known files. Nothing is submitted or changed.
-
3
Get a plain-English report
See what we found, why it matters and how to fix it, most serious first. Download it to send to your developer.
A report you'll actually understand
Every finding comes with what we saw and what to change. When something can't be checked from outside, the report says so instead of guessing.
- Evidence for every findingThe exact page, file or header, so you can confirm it yourself.
- Fixes in plain EnglishCopy them straight into a message to your developer.
- Honest about limitsHidden versions and failed lookups are reported as gaps, never as an all-clear.
- 4 critical
- 3 high
- 6 medium
Critical Git repository exposed (.git/HEAD)
- Evidence
HTTP 200, 21 bytes; content matches /.git/HEAD signature- Suggested change
- Block access to /.git (and remove it from the web root). Attackers can reconstruct your source code and history.
- Critical Environment file exposed (.env)
- High CORS reflects arbitrary origins with credentials
- Medium Outdated jQuery 1.12.4 with known vulnerabilities
What we check
Everything a careful visitor can see from outside. See every check in detail
-
Outdated software
Versions found in your scripts and pages. Supported ones are looked up in OSV.dev during the scan.
-
Hijacked packages
Scripts matched against GitHub's malware advisories and the incidents we track.
-
HTTPS and certificates
Redirects to HTTPS, certificate trust and expiry, outdated TLS.
-
Security headers
Content-Security-Policy, HSTS, framing protection and more.
-
Cookies
Secure, HttpOnly and SameSite on anything that looks like a session.
-
Leaked secrets
API keys and credentials shipped to the browser in page source or JavaScript.
-
Exposed files
Public .git and .env files, database dumps, phpinfo pages.
-
Forms and CORS
Passwords sent insecurely, missing CSRF tokens, risky cross-origin rules.
What we're watching this week
Tracking 520 malicious npm packages published in the last 48 hours and 16 researched incidents. Last synced .
-
01
This week's malicious npm packages
520 npm packages flagged as malware in the last 48 hours, plus every older malicious version on record
-
02
Collabora Built-in CODE Server for Nextcloud exploited to plant web shells
Nextcloud office add-on exploited to plant web shells; CISA lists it as exploited (Oct 23)
-
03
Arista VeloCloud Orchestrator SQL injection exploited as a zero-day
Network orchestrator zero-day lets read-only users take over; exploited (Oct 22)
-
04
LiteLLM 1.107.0 release-pipeline compromise
Backdoored release of a popular AI gateway steals server credentials (Oct 21)
-
05
Cisco Secure Email Gateway file-write flaw under active attack
Email security appliance flaw lets attackers write files; under active attack (Oct 14)
-
06
Rank Math SEO PRO 3.0.123 backdoored at the vendor
Backdoored WordPress SEO plugin shipped from the vendor (Oct 15–16)
-
07
Stolen UpdraftCentral keys used to plant backdoor plugins
Stolen backup-dashboard keys used to plant backdoor plugins (Oct 18–19)
-
08
Shopify apps turned into checkout phishing redirects (HulkApps, Selleasy, Swym)
Shopify app settings injected a fake-checkout redirect that steals cards (Oct 10–16)
-
09
eMudhra / emSign intermediate certificate keys compromised
Certificate authority keys compromised; browsers distrust the certificates (Oct 17–20)
-
10
polyfill.io CDN takeover
Hijacked script CDN still referenced by many sites (since 2024)
Full write-ups and a quick check for your site Ranking reviewed
Safe to run on your live site
An audit only does what a careful visitor could do. That's what makes it safe to point at production, and it's also why it can't replace a penetration test.
- Read-only. Plain GET requests for pages and a short list of well-known files. No forms are submitted and nothing is logged into.
- No attack payloads. No injection strings, fuzzing or brute force. Ever.
- Gentle. Three requests at a time with a pause between batches, and a hard cap on pages.
- Permission first. Every audit requires confirming you own the site or are authorized to test it.
- Can't be aimed inward. The server refuses to reach private and internal network addresses.
Questions
Will this slow down or break my site?
No. An audit is a few dozen ordinary page requests, spread out, from a single client. It's lighter than one person clicking around for a minute.
Does a good grade mean my site is secure?
It means none of the common, visible misconfigurations turned up. Passive checks can't find injection bugs, broken access control, or problems behind a login. Treat it as a strong first pass, not a guarantee.
Can the AI get things wrong?
Yes, which is why every finding shows its evidence and Claude's verdict separately. Anything Claude inferred on its own is labelled unverified, and findings it dismissed stay visible so you can disagree.
Can I audit a site I don't own?
Only with the owner's permission. See responsible use.
Ready to check your site?
Free while in beta. Most audits finish in under a minute.