30+ checks, full transparency

Every check, every signal,
explained in plain English.

We don't believe in black boxes. Here is every security signal we run against your domains, inboxes, and websites — and what each one means for your business.

How we’re different — #1

The attack-path engine

Most scanners hand you a pile of separate alerts and leave you to guess which ones matter together. We connect your open issues into the exact route an attacker would take through your business — in plain English, easiest route first.

Free on every plan, including the trial.

How we’re different — #2

The fix-it ladder

Every finding comes with a fix ladder: exact copy-paste steps your developer can run today, and for DNS and Cloudflare changes, a one-click fix — we show you the change, you approve it, we apply it, then we re-check it worked.

Active changes only happen when you opt in.

Continuous monitoring

Once you connect a domain we keep scanning it — hourly for critical checks, daily for the full sweep — so a new issue doesn’t sit undetected for weeks.

Plain-language alerts, incl. WhatsApp

Every alert is written in business language, not security jargon. Email today; WhatsApp critical alerts are launching soon, pending WhatsApp Business approval.

WhatsApp: launching soon

GitHub launch gate

Connect a repo and every pull request is checked for secrets and vulnerable code before it merges — a pass/fail status right in your GitHub Checks tab.

Insurance & questionnaire pack

Pass your customer’s security questionnaire and get insurance-ready — a citation-backed summary of the controls you actually have running, and the gaps still open.

Verifiable trust badge

An embeddable, live-updating badge for your site or storefront — auto-revokes if a rescan turns up a new critical issue, so it always reflects reality.

Underneath the attack-path engine and fix-it ladder, here's every individual check and signal that feeds them — the same 30+ checks, in full detail.

Email security

The #1 attack vector for SMEs — and the first thing a security-literate buyer asks about.

  • SPF record validation

    Parses v=spf1, detects +all permissive flag, warns on DNS lookup limits.

  • DMARC policy monitoring

    Alerts if p=none or missing; tracks changes over time.

  • DKIM selector probing

    Checks common selectors (default, google, mail, selector1) for active keys.

  • MX + STARTTLS

    Ensures mail servers support transport-layer encryption.

  • Email blacklist check

    Queries MXToolbox reputation sources.

SSL / TLS

Downtime from an expired cert is embarrassing and expensive. We prevent both.

  • Certificate expiry countdown

    90/60/30/7/1-day warnings. Critical alert if <7 days.

  • Cipher strength + TLS version

    Flags TLS 1.0/1.1, weak ciphers, insecure negotiation.

  • Chain validation

    Detects missing intermediate certs and mismatched SANs.

  • HTTP → HTTPS redirect

    Ensures all traffic is encrypted end-to-end.

  • Mixed content

    Detects http:// resources loaded on https:// pages.

Security headers

Standard hardening that most SMEs skip because their hosting provider doesn't set defaults.

  • HSTS

    Strict-Transport-Security with min 15,552,000s max-age.

  • X-Frame-Options

    Prevents clickjacking via iframe embedding.

  • Content-Security-Policy

    Validates CSP exists and is not overly permissive.

  • X-Content-Type-Options / Referrer-Policy / Permissions-Policy

    Standard browser hardening.

  • Server version disclosure

    Flags Server: nginx/1.x or Apache/2.x headers.

Exposed paths

The embarrassing stuff: config files, backups, database dumps sitting in web roots.

  • .git / .env exposure

    Probes common paths; critical finding if response contains secrets.

  • phpinfo() / admin panels

    Detects /wp-admin, /admin, /phpmyadmin, /info.php.

  • Backup artefacts

    .sql, .tar.gz, .zip, .bak files in root or common paths.

  • Directory listing

    Detects Apache/nginx autoindex enabled.

Brand protection

Someone registered yourbank-login.com three days ago. You should know now, not after a phishing campaign.

  • Typosquatting detection

    dnstwist-based permutations: character swap, homoglyph, hyphenation, TLD swap.

  • Domain risk scoring

    Weights MX, SSL age, website content similarity, WHOIS age.

  • CT log monitoring

    Daily crt.sh polling for new cert issuances mentioning your brand.

  • Defensive portfolio

    Namecheap-powered buy links for critical typosquats.

WordPress + Magento

80% of SME breaches start in a CMS. We monitor both continuously.

  • WP / Magento version + plugin CVE scan

    Cross-references wpvulnerability.com + OSV.

  • Magecart skimmer detection

    Hashes payment-page scripts and flags unauthorised injections.

  • Third-party script audit

    Inventory of every external JS; alerts on new additions.

  • PCI DSS basic controls

    Automated checks against the PCI SAQ A-EP control set.