Free · No sign-up · 30 seconds
Just enter your domain. We score the weak spots anyone can see from the outside, show in a short story how an attacker would go after you, and tell you what to fix today to stop it.
Email anti-spoofing
Whether you have the settings (SPF, DMARC) that stop fake emails pretending to be from your company
Encrypted connections
Whether your site opens over https, the certificate is valid, and it is not about to expire
Basic website settings
Whether settings that prevent hijacking and tampering are in place, whether your site reveals its software versions, and whether WordPress is out of date
Forgotten entry points
Whether public certificate records still list test sites or old sites
What we do not check (so it is safe to enter anyone's site)
This check does only four things: look up DNS, receive the certificate, open the home page once, and read public certificate records. It does not probe ports, search for files or try out weaknesses. Those are done in the free in-depth scan (first one free) (14,104 tests), only after the owner registers and gives permission.
The quick check answers only the top row. Paid plans do everything the quick check does, and answer the rest of the questions too.
| What you want to know | Quick check | Paid plans |
|---|---|---|
| Are my email anti-spoofing, certificate and https settings OK? | ✓ | ✓ |
| Are there holes that would let someone take over my site? | ✗ Not covered | Checked with 14,104 tests |
| Are files containing passwords visible from the outside? | ✗ Not covered | ✓ |
| Can someone reach the database holding customer data from the outside? | ✗ Not covered | ✓ |
| Are admin or VPN login pages exposed to the internet? | ✗ Not covered | ✓ |
| Are my WordPress plugins and server software out of date? | ✗ Not covered | Checked from the inside(Standard plan) |
| If a new weakness is published tomorrow, will I know? | ✗ Not covered | Alert within half a day |
| Will I notice an expiring certificate or a changed setting right away? | ✗ Not covered | Watched every day |
| Do I know exactly what to fix and how? | One line only | Steps tailored to your setup |
| After fixing, can I confirm it is really fixed? | ✗ Not covered | Re-check with one button |
| What if a business partner asks for my security status? | ✗ Not covered | Documents for METI's "SCS ★3" scheme (Japan) |
| Do I get a report I can show my team or partners? | ✗ Not covered | Monthly PDF |
Paid plans: on top of the quick check
Here is what else we do
Real checks with 14,104 tests
We try each publicly known weakness one by one to confirm whether a takeover hole really exists, and repeat every week, focusing on what changed.
New weakness? You hear within half a day
Twice a day (6:00 and 18:00 Japan time) we match newly published weaknesses against your servers and alert you only about the ones that affect you.
How to fix it, and "I fixed it, check again"
You get steps for your type of server. Once fixed, one button re-scans just that issue and records that it is fixed.
Inside your servers, PCs and WordPress
Unsupported software, outdated plugins, weak settings, even traces of a break-in, found by a read-only program (internal scan).
Partner documents with one button
A PDF of your security status following the 26 items of METI's "SCS ★3" scheme (a Japanese government framework). Items the scan can answer are filled in automatically.
Finds forgotten entry points too
Every morning we look for old campaign sites and test sites, and alert you right away if one could be taken over.
Even when the quick check says "no problems", the in-depth scan can find things like these
(Real findings on our own practice servers)
Paid plans start at USD 19 per server per month. Your first scan is free, and no payment details are needed.