Security check · free
The security check. What attackers see from outside.
The security check checks your website or web app. We attack nothing and need no login. You get a grade from A to F, the findings by severity and concrete advice for each one.
- Price
- free
- Delivery
- usually within 2 hours on working days
- Access
- URL and email address
- Result
- Grade A–F and findings
What we check
- Grade from A to F and number of findings
- Encryption, security headers, cookies
- Exposed files and endpoints
- Visible versions with known flaws
How it works
Methodology- 01
Enter the address
URL and email address, that is all we need.
- 02
Check
TLS, headers, cookies, exposed files and visible versions. No attack, no login.
- 03
Get the result
Grade, findings and advice by email, usually within 2 hours on working days.
What you get
View sample report (PDF)- Overall grade from A to F
- Number of findings by severity
- Concrete advice for every finding
- Which audit is worth it for you
Compared
| Security checkfree | App audit€490 | Code audit€890 | Full audit€1,690 | EnterpriseOn request | |
|---|---|---|---|---|---|
| What is tested | |||||
| TLS, security headers, cookies | included | included | partly | included | included |
| Login, sessions, rate limits | not included | included | included | included | included |
| Access rights: can user A see user B’s data? | not included | included | partly | included | included |
| Injection (SQL, XSS, SSRF) | not included | partly | included | included | included |
| Secrets and keys | partly | partly | included | included | included |
| Supply chain, Docker, CI/CD | not included | not included | included | included | included |
| What you get | |||||
| Grade and number of findings | included | included | included | included | included |
| Report with a prioritised action plan | not included | included | included | included | included |
| CVSS 3.1 ratings | not included | included | included | included | included |
| Debrief and re-check | not included | not included | not included | included | included |
| Framework | |||||
| Access | URL and email address | Address + 2 test accounts | Read access to the code | URL, test accounts and code | individual |
| Delivery | usually within 2 hours on working days | 1 working day | 2 working days | 4 working days | individual |
Frequently asked questions
Is the security check really free?
Yes. No subscription, no obligation. In-depth audits are optional and paid.
Does the check attack my website?
No. We only read publicly visible information, as any browser does. No login, no attacks, no load.
What can the check not see?
Anything behind the login and in the source code. That is what the app audit and the code audit are for.