Website check
The check only looks at what your site has already shown the internet.
That is not modesty, it is a legal line. Anything your site shows to every visitor, I am allowed to look at too. What sits behind a login or inside a database, I am not — until you permit it in writing.
Publicly exposed
Data your site already serves to every visitor. Nothing gets unlocked.
- plugins and themes with their versions — matched against the Wordfence database
- TLS certificate
- security HTTP headers
- DNS hygiene — SPF · DKIM · DMARC
- subdomains — from public sources
- open ports
- exposed files
Full findings. Free. In 15 seconds.
The deeper scan
Tests that push data into your application and wait for it to react. Without your written authorisation that is not a service, it is a criminal offence.
- SQL injection and related tests
- active probing of forms
- anything behind a login
- privilege escalation
- internal network
- testing people — phishing scenarios
This is agreed by signature, not by clicking.
Rules I hold to
The findings are yours, in full, immediately.
The check runs on a single server in Germany. Your findings, your address and your email go nowhere. To list subdomains, it asks the domain name to public sources that publish that data anyway — which, honestly, means the domain name does leave my server; all of it is written down in the privacy policy.
Nothing is locked away
No “we found seven issues, pay to see which”. Whatever I find is written out — name, version, and what exactly is wrong with it. The report is yours and you are free to forward it to anyone.
Easy things, you fix yourself
Most findings come with step-by-step instructions. If you follow them and never call me, the check did the job it exists for.
An honest detection limit
An external check recognises roughly 60–70% of plugins. That is written in the report too. I would rather tell you what I cannot see than hand you a list you cannot rely on.
Confirmation that the site is yours
There is no registration, but before the findings I ask for a code sent to an email address on the domain being checked. That is how it is known you are looking at your own site, not someone else’s. The report is still on screen, not in the mail.