Security check · free
The security check. What attackers see from outside.
The security check looks at your website or web app from the outside, just as every bot does. Passive only: we attack nothing and need no login. You get a grade from A to F and the number of findings, with details once you verify your domain.
- Price
- free
- Delivery
- within 2 hours on working days
- Access
- URL and email address
- Result
- Grade A–F and findings
What we check
- Grade from A to F and number of findings
- Encryption, security headers, cookies
- Exposed files and endpoints
- Visible versions with known flaws
How it works
- 01
Enter the address
URL and email address, that is all we need.
- 02
Passive check
TLS, headers, cookies, exposed files and visible versions. No attack, no login.
- 03
Get the result
Grade and findings within 2 hours on working days, details after domain verification.
What you get
- Overall grade from A to F
- Number of findings by severity
- Concrete advice for every finding
- Which audit is worth it for you
Compared
| Security checkfree | App auditfrom €990 | Code auditfrom €1,900 | Full auditfrom €5,900 | EnterpriseOn request | |
|---|---|---|---|---|---|
| What is tested | |||||
| TLS, security headers, cookies | |||||
| Exposed files, admin and debug pages | |||||
| Login, sessions, rate limits | |||||
| Access rights: can user A see user B’s data? | |||||
| Injection (SQL, XSS, SSRF) | |||||
| Secrets and keys | |||||
| Dependencies and known CVEs | |||||
| Supply chain, Docker, CI/CD | |||||
| Code quality and maintainability | |||||
| Architecture review and threat modelling | |||||
| Cloud infrastructure (AWS, Azure, Kubernetes) | |||||
| What you get | |||||
| Grade and number of findings | |||||
| Report with a prioritised action plan | |||||
| CVSS 3.1 ratings | |||||
| Code findings proven in the running app | |||||
| Expert review of every finding | |||||
| Debrief and re-check | |||||
| NIS2 and CRA readiness mapping | |||||
| Dedicated contact, recurring audits | |||||
| Framework | |||||
| Access | URL and email address | Address + 2 test accounts | Read access to the code | URL, test accounts and code | individual |
| Delivery | within 2 hours on working days | 3 working days | 5 working days | 10 working days | individual |
includedpartlynot included
Frequently asked questions
Is the security check really free?
Yes. No subscription, no obligation. In-depth audits are optional and paid.
Does the check attack my website?
No. We only read publicly visible information, as any browser does. No login, no attacks, no load.
What can the check not see?
Anything behind the login and in the source code. That is what the app audit and the code audit are for.