Your website, checked from the outside, every month. Free.
One line: sign up with an email at your own domain, and the scanner looks at your site the way an attacker's bot would, then emails you a plain-English graded report, now and every month. Free forever, no paid tier.
Grade B. Two things to fix.Nothing urgent. Fix the email record first, the headers when you next deploy.
- AEncryption (TLS)Modern settings, certificate valid for 71 more days.
- CEmail spoofing protectionSPF is set. DMARC is missing, so anyone can send mail as example.com.
- CSecurity headersNo content security policy. Three other headers present.
- AExposed filesNo .git, .env or backup files reachable.
- AOpen portsOnly 80 and 443 answer from the internet.
- BWordPressCore is current. One plugin is two versions behind.
Outside view only. The inside, your cloud accounts, people and policies, is a different job.
Outside of the building
Most break-ins are not a hacker typing fast. They are a bot quietly trying every door of every building on the street until one is left open.
This scanner walks the same street, once a month, and tries your doors politely. It reads what your site tells anyone who asks: the encryption on the connection, the headers your server sends, whether anyone can send email pretending to be you, whether a backup or config file was left where the public can fetch it, which ports answer, and how old your WordPress is.
It never goes inside. It does not log in, guess passwords, submit forms or run attacks. It makes at most 25 ordinary web requests, the same kind a browser makes, and it identifies itself on every one. Every check, in plain words.
The report tells you what was found, why it matters, what to fix first, and roughly how hard the fix is. A grade per check and one grade overall, like a school report, not a 40-page PDF.
Two levels, both free
Free forever, no paid tier. The scanner never scans a site for someone who cannot prove it is theirs. There are two ways to prove it.
Confirmed email
Sign up with an address at the domain and click the link in the confirmation email. Read-only checks of what the site already shows the public.
- Encryption and certificate
- Security headers
- Email spoofing protection (SPF, DMARC, DKIM)
- DNS hygiene
- Exposed files and folders
- WordPress core and plugin versions
- Mixed content and old libraries
- Open ports, the common ones
Verified domain
Prove you control the domain with one DNS TXT record or one small file on the site. Takes five minutes. Then the monthly scan crawls the whole site, not only the home page.
- Everything in the confirmed-email level
- A crawl of every page the site links to
- Passive rules on every page: cookie flags, headers, information leaks, old JavaScript libraries, forms that post over plain http
- Still no attack. It reads what each page sends back and changes nothing
- Agencies: verify each client domain once and get every report
At both levels the scanner never submits forms, never logs in and never attacks. An active scan, the kind that can create, modify or delete data, is coming later as a separate yes for each domain, with the scanner's own warning shown first. It is never on by default.
What the scanner never does
No attacks
No exploits, no injection attempts, no password guessing, no flooding. Nothing is sent that could change or break your site.
No logging in
The scanner only looks at what the public can already see. It never uses a password, a cookie or a session, yours or anyone else's.
No surprises
At most 25 requests per scan, from one fixed, named IP address, each with a User-Agent that names this site and links to a page explaining it. Details for site owners and hosts.
Who makes it
I am Adam Ridley. I run Human Compute LLC in Winston-Salem, North Carolina.
The outside is the easy part, and I think every US business should get it for free. The inside, your cloud accounts, your people's access and your written policies, is where I do paid work: getting a company aligned with SOC 2 controls, checked weekly, so it is ready the day a big customer asks for the report. That is readiness work, not a certificate. No audit has been done on any of it, and this scan is not part of SOC 2.
The monthly email is the whole business model: it keeps your site in good shape and it shows you what I do. There are no ads, there is no paid tier, the list is never sold, and if a sponsor ever appears in the email it will be marked Sponsored and will see only how many people are on the list.
Questions, problems or an abuse report: abuse@securityscanner.org.