How it works

From first look to verified fix

1. Free snapshot

You enter an address. Our scanner loads the page once, as a browser would, and inspects the connection, headers, cookies, the scripts it references, and public DNS. It never submits forms, guesses paths or sends test payloads. You get a health indicator, the areas that deserve a closer look, and the practices the site already gets right.

2. Ownership verification

Before anything beyond the passive snapshot, you prove control of the website by adding a DNS TXT record or publishing a small file. Verification is per hostname and is re-checked before every review.

3. Authorization

You sign a scope authorization stating which hostnames may be assessed, what methods are permitted, any exclusions, and a validity period. We keep this record with your name, time and address. Active testing additionally needs a testing window and our approval.

4. The review

A standard review runs non-destructive checks: discovery of exposed configuration and backup files, cookie and CORS behaviour, authentication hardening, vulnerable client-side libraries, framework-specific issues, OpenAPI exposure and more. Every finding records its evidence, severity and confidence separately.

5. Explanation and review

Findings are deduplicated against your previous assessments. For each one, an AI analyst writes a plain-language explanation, business relevance and remediation guidance from the evidence only; it cannot invent endpoints, exploits or consequences. High-impact or ambiguous findings are reviewed by a person before delivery.

6. Reports

An executive report and a technical appendix are generated from an immutable snapshot of the assessment, as PDF and editable PowerPoint. Reports always state scope, exclusions, coverage and limitations.

7. Fixes and proof

Choose which findings to address and request a quote. When work is complete, a verification assessment produces a before-and-after report. A finding is marked resolved only when the scanner no longer observes it.

8. Monitoring

Optionally, we re-assess on a schedule and alert you only when something actually changes: a new issue, a resolved one reappearing, a certificate about to expire.