Forty plus checks across your perimeter.

We identify what runs your site so every other check knows where to look. Keeps false positives low and remediation advice specific to your stack.

Every detected component is matched against its disclosed security holes. We prioritise findings where a public exploit exists, so you fix what matters first.

Browser hardening every modern site should ship. We also check cookie Secure, HttpOnly, and SameSite attributes on session and login cookies.

We extract and flag credentials accidentally shipped to the browser. The classic source of unexpected billing surprises and account takeovers.

The high-impact misconfigurations that show up in real breach post-mortems. A .git directory is treated as critical because anyone can clone your source.

Bounded plugin and theme version enumeration, xmlrpc exposure, wp-json user enumeration, app-proxy fingerprinting. CMS-specific because the attacks are CMS-specific.

A bounded crawl plus a small fuzz pass. We do not log in, we do not test business logic, we do not claim full OWASP Top 10. Anything deeper is pentest territory.

We detect introspection and surface the queryable types. Production GraphQL endpoints almost always want introspection disabled.

JavaScript source maps in production let anyone read your original module structure. We detect and flag them so you can ship them only to authenticated users or strip them entirely.

Pages that leak framework version, file paths, or database errors when probed with malformed input. Useful reconnaissance for an attacker, easy to suppress in production config.

We verify the SPF record exists, is syntactically valid, fits within the 10-lookup limit, and ends with a -all or ~all hard fail rather than a permissive policy.

We discover active DKIM selectors via common provider naming and confirm the published key signs outbound mail. Weak keys (under 1024 bits) and unused selectors are flagged.

We surface the policy and flag domains with no DMARC or with p=none only, which are spoofable in practice. We also check the reporting addresses are reachable.

The pieces most operators forget after SPF, DKIM, and DMARC. Without MTA-STS, your inbound mail can be downgraded to plain text by an attacker on the path.

Brand Indicators for Message Identification need DMARC at p=quarantine or stricter plus a verified mark certificate. We flag whether you qualify and what is missing.

Variants of your domain that an attacker could register and use for invoice fraud or customer impersonation. We flag the ones that have been registered.

Useful context for the rest of the report and for shaping remediation advice. Provider-specific fix steps are easier to follow than generic ones.

CT logs, search engines, and code search, paired with bounded active probing. We surface forgotten subdomains before the attacker does.

A complete record of your DNS posture. Surfaces dangling records, weak CAA policies, and provider drift that nobody notices until something breaks.

CDN, cloud provider, and ASN context attached to each result. We do not full-port-sweep your edge by default; that is intrusive and not useful at this cadence.

Azure, Heroku, GitHub Pages, S3, and similar. We verify both DNS evidence and an unclaimed-site marker before flagging, so this finding is real every time it ships.

TLS versions supported, weak ciphers, certificate expiry and rotation hygiene. We detect Heartbleed, POODLE, BEAST, and Sweet32 conditions on legacy endpoints.

S3, Azure Blob, and GCS lookups under exact and common domain-derived names. We only flag verified public listings, not guesses.

Continuous passive discovery of new CT log entries. Catches shadow IT and unauthorised issuance the moment it shows up in a public log.

A live inventory of your supply chain in the browser, with provider context. Helps trace stale integrations and supply-chain risk.