Is Your Website Ready for the Next Vulnerability?
Scan your public website for runtime, TLS, certificate, container and known vulnerability risks.
Example result. Your report shows your own site.
How it works
- 1
Enter your address
Paste the public address of a website you are authorized to assess and confirm it.
- 2
We check from the outside
Safe, passive checks of availability, certificate, headers and the software your server announces.
- 3
We compare with known vulnerabilities
Detected versions are matched against a vulnerability database. Every conclusion shows its evidence.
- 4
You get a plan
Plain-language findings with step-by-step fixes, then a verification scan to confirm they worked.
What we check
Availability
HTTP and HTTPS reachability, redirects, response time, HTTP to HTTPS redirect.
TLS and certificates
Validity, expiry, issuer, chain, signature, protocol versions and weak cipher indicators.
Security headers
HSTS, CSP, nosniff, framing, referrer and permissions policies, cookie flags.
Technology
Web server, PHP, CMS and frameworks, identified passively and never assumed.
PHP runtime
Version confirmed, likely or unknown, matched to published vulnerabilities.
Certificate authority events
Your chain compared with known CA incidents, flagged only when intelligence supports it.
An example security report
One score, clear severities, and the evidence behind each conclusion.
Example site: example.com
One critical finding is confirmed by evidence.
Findings by severity
- critical2
- high3
- medium5
- low4
- unknown1
Score by category
PHP runtime appears vulnerable to a published vulnerability
- Detected
- PHP 8.2.12
- Affected
- According to current vulnerability intelligence
- Fixed in
- Taken from the vendor advisory
Header: X-Powered-By: PHP/8.2.12
Captured 2026-10-22 23:00 UTC · confidence: Confirmed
Why runtime security matters
Your application can be fully up to date and still be exposed. The runtime, web server, TLS libraries and operating system sit below your code, and flaws there are not fixed by updating your dependencies.
PHP runtime vulnerabilities, such as the recent PHP2Shell pair, are an example: they are patched in the runtime itself.
Known vulnerability
A published CVE that matches software we detected, shown with the evidence and the fixed version from the advisory.
Security hardening recommendation
A best practice that lowers risk, such as a missing security header. It is never labeled a CVE.
Container security
A website address cannot show what is inside your container. That is why there are two scan modes, and we never claim an image is vulnerable from a URL alone.
Website scan
Give us a public address. We run passive, outside-in checks.
Container image scan
Give us an image reference. We inspect OS packages, PHP, OpenSSL, CA certificates, libraries and dependencies, and count Critical, High, Medium, Low and Unknown.
24×7 Security & DevOps support
Found something? Our security and DevOps team can fix it with you.
- Vulnerability remediation
- Cloud security
- Container security
- Kubernetes security
- Azure/AWS security
- DevSecOps
- Infrastructure hardening
- Patch management
- Incident response
Frequently asked questions
Is it safe to scan my site?
Yes. Checks are passive: we read what any visitor can see, use ports 80 and 443 only, and never try to exploit anything.
Can I scan any website?
Only websites and infrastructure that you own or are authorized to assess. You confirm this before every scan.
Why does it say a version “could not be confirmed”?
Many servers hide their versions. We never guess: when evidence is missing we say so and suggest a container or image scan.
What is the difference between a hardening recommendation and a known vulnerability?
A hardening recommendation is a best practice, such as a missing header. A known vulnerability is a published CVE that matches software we detected.
Can you tell if my Docker image is vulnerable from my website address?
No. A public address cannot show what is inside a container. Scan the image itself to check OS packages, PHP, OpenSSL and libraries.
Does a clean report mean I am fully patched?
It means nothing was found in what we could verify remotely. Layers we cannot see are marked clearly in the report.