変更内容

AWS Certified Solutions Architect – Associate (SAA-C03) exam prep at /academy_saa: 270 original architecture scenarios across the four exam domains and 14 task statements, each with an explanation, practice by domain and task with a spaced review of mistakes, and a timed 65-question mock exam weighted 20/17/15/13 like the blueprint (free account). The Academy exam engine now serves every exam from one place.

AWS Certified Security – Specialty (SCS-C03) exam prep at /academy_scs: 349 practice questions across the six exam domains with explanations, practice by domain and task, a spaced review of mistakes, and a timed 65-question mock exam weighted like the blueprint, scored on the server (free account).

Agent-ready website: /llms.txt summary, a Markdown homepage for AI agents (Accept: text/markdown or /index.md), a Link header advertising both, Content-Signal in robots.txt (search and AI answers allowed, AI training not), the public contact email in the Organization schema, read-only WebMCP tools for in-browser agents, and a public read-only MCP server at /mcp with its Server Card and AI Catalog.

Security Agent: "Check before deploying" runs NeoShield's own scan rules on pasted response headers, DMARC or SPF records and shows which would pass, without AI and without using a request. Every configuration draft and plan the agent writes is checked with the same rules before you see it. The agent can also look at the score history of the same website, and answer in English and Japanese together.

AI features now use Anthropic's current Claude 5.5 models, matched to the job: quick, evidence-based answers (scan summaries, scam and phishing checks, the tutor, the Security Agent) use Claude Haiku 5.5, and code, configuration and incident analysis use Claude Sonnet 5.5. The Security Agent adds a prioritized plan for all open findings, a platform choice (nginx, Apache, LiteSpeed/Hostinger, Cloudflare, WordPress, IIS, CloudFront) and follow-up questions on an answer.

NeoShield Security Agent for Pro and MSP / Team: on a scan report, ask for an explanation of a finding, a remediation plan, a configuration draft or review, a rollback plan, a verification checklist, a client summary, a developer ticket or a comparison with the previous report. Answers are drafts grounded in the scan evidence, labelled by source, in English or Japanese. Secrets and email addresses are removed before anything is sent to the Claude API, nothing is applied automatically, and only a Verify Fix rescan can mark a finding resolved. Monthly and daily request limits apply.

Free scans now show the name, severity, basic evidence and confidence of every critical, high and medium finding; the full fix steps, exports and verification stay in paid plans. Reports separate confirmed findings from items that need review, use the label "Observed configuration score", and give fix priorities from P0 (Immediate action) to P4. DNSSEC is reported only from the DS and DNSKEY records, MTA-STS and TLS-RPT are no longer raised for domains that receive no email, and COEP is suggested only where it applies. New navigation with Free Tools, Academy and a separate NeoShield Labs area for experimental tools, a homepage that starts with the scan, and Team marked Early Access. Scan authorization records now store the Terms version.

Rebuilt client PDF report: a clickable contents page, the score breakdown showing the points each confirmed finding removed, coverage and confidence, confirmed findings kept apart from items to review, fix priority (P0 to P4) with a remediation roadmap, a plain-language explanation for the client on common findings, Deep Scan module results, the authorization record, a standards mapping appendix and version details. Everything printed comes from the stored scan.

Clearer website copy for agencies: a new homepage headline, a comparison with free security checkers, profiles of who NeoShield is for, product screenshots from the sample report, a planned Monthly Security Summary shown with example data, a plain-language Refund Policy page, a Trust Center summary of how NeoShield itself is secured, and finding explanations for developers and clients on the methodology page. The sample report now rates a missing HSTS header as High, as the scanner does.

Repositioned for freelance developers and small web agencies: the homepage leads with the complete sample report, explains what is and is not checked, who the service is (and is not) for, and who runs it. Navigation is simpler: Product, Sample Report, Pricing, Resources and Trust Center; the tool library and Security Lab now sit under Resources.

Free reports now show the title, severity, affected host and a short explanation of every high and critical finding. Evidence and fixes for those findings remain part of Pro.

Pricing puts the website-reporting comparison first (users, websites and their scope, scans, monitoring frequency, exports, what happens after expiry, support) and adds answers on the operator, SLA, white-labelling, manual review and penetration testing. The MSP / Team website limit is stated the same way everywhere: up to 25 monitored websites per user, and 25 per workspace for the client list and Security Center.

Trust Center and Security pages state that NeoShield is solo-operated, describe backups, monitoring, incident communication and what happens when the operator is unavailable, and no longer claim restore testing that has not been evidenced. New Methodology page.

Advertising (after consent) is limited to blog articles, as the Cookie Policy states; product, pricing and scanner pages never load it.

Security Center for every plan: Free accounts now get a Security Center for their own website with events, cookie-free visitor analytics, security-header checks and uptime monitoring. Pro adds blocking, file integrity, tripwires, cases, threat intelligence and AI analysis; MSP / Team adds the shared workspace tools.

Website agent 2.0 and a WordPress plugin: report attacks, failed logins, administrator and plugin changes, and changed code files to your Security Center. Blocking is optional per website (Pro and MSP / Team) and never applies to IPs on your allowlist.

The agent download on the Websites page delivered an empty file; it now downloads correctly, and agent events are stored for every website.

New homepage: start a scan straight from the first screen, see a real sample report page, and follow one finding from evidence to a platform-specific fix and the rescan that confirms it. Plans, scope limits and trust commitments are shown plainly, in English and Japanese.

Clearer menus: Security Tools now opens as four labelled columns with nothing hidden behind a scrollbar, and a new Resources menu puts the blog, manual, support and contact pages in plain view. Menu labels no longer wrap onto two lines on laptop-width screens, and the header Scan Free button text is easier to read.

Release emails: administrators can send a bilingual release notice to customers in controlled batches, starting with a small test group. People who unsubscribed, bounced addresses, test accounts, duplicate mailboxes and accounts being deleted are never emailed.

Structured data now matches what each page shows: Japanese pages carry Japanese FAQ markup, and manual pages no longer declare section lists as FAQs. Signed-out visitors reach the sign-in page in one redirect instead of two.

When a Deep Scan is skipped because a domain is not verified, you can now verify the domain right from the scan result (DNS record or file) and check it in one click. Platform administrators can Deep Scan the platform's own domain.

Team workspaces now have roles: Administrator, Scan operator, Analyst, Auditor and Viewer. The workspace administrator assigns them on the Team page, and each action in the scanner checks the role on the server.

Accepting a risk now needs a written reason, a named owner and an expiry date no more than a year away. When it expires, the finding reopens on the next scan. Marking a false positive needs a note.

Finding status changes are recorded in a tamper-evident log, and the administrator audit log now protects every field of each entry.

Sign-in codes: wrong guesses sent at the same moment are now counted one by one, so the five-attempt limit holds under load.

Scan reports no longer keep link tokens, session values or similar secrets that a scanned site placed in its redirects or pages. Older saved reports are cleaned when opened or exported.

Background scans are shared fairly between accounts, with up to 20 queued or running scans per account. Failed background scans show a reference number instead of internal error text.

Scanner safety: every request the scanner and tools make now goes through one hardened network layer that only reaches public addresses, re-checks each redirect, and limits size, time and number of requests per scan.

The Deep Scan, background scans and scheduled monitoring now run only on domains you have verified (DNS record or a file under /.well-known/). On other domains the standard passive scan runs and the report says the Deep Scan was skipped.

Every scan report now records why the scan was allowed (verified domain, written exception or your confirmation), its scope and its request budget.

The common-ports page is now a reference list; the live check of this server's own ports is limited to administrators.

The free security tools now run right on their own page: type a URL, token, IP or CVE and get the result below, no extra click.

Deeper results in seven of the most-used tools: the Security Header Checker reviews your CSP directive by directive and each cookie, and gives copy-paste fixes for nginx, Apache, IIS, Cloudflare and PHP.

The JWT auditor warns when a token is still signed with a sample secret from a library tutorial; the phishing checker spots look-alike domains, open-redirect links and recipient email hidden in a URL.

The CVE lookup now gives one patch-priority answer from NVD severity, the CISA exploited-vulnerabilities list and FIRST EPSS exploit probability.

Every tool result can be downloaded as JSON or CSV, printed or saved as PDF, and — when you are signed in — saved to your history for 90 days or shared with a private link.

Cookie choices: analytics and advertising now load only after you accept them, with separate switches and equal Accept and Reject buttons. Change your choice any time from "Cookie settings" in the footer.

New Account page: see where you are signed in, sign out other sessions, download your data, and request account deletion.

Sign-in hardening: sign-in codes are stored with a keyed hash, repeated wrong codes are limited, and sessions end 12 hours after sign-in.

Scheduled monitoring now requires proof that you control the domain (DNS record or verification file). Existing schedules keep running until 2026-11-30 while you verify.

Stronger protection for tools that fetch web addresses, safer CSV exports, and team invitation links that work once and need a confirmation click.

The status page now reports each component from real checks, with last-check times, incident history and a machine-readable feed for uptime monitors.

Privacy, Security, Cookie Policy, Trust Center and Responsible Disclosure pages rewritten to describe only what the service actually does, with a full cookie and subprocessor list.

日本語に完全対応しました。すべてのページ、ツールの結果、法的事項のページを日本語で表示でき、AI ツールは日本語で回答し、日本語のキーワードでツールを検索できます。

よく使われている無料ツールをホームページの上部にまとめ、メニューを用途別に整理しました。

一部の環境で Stripe の決済画面に進めなかった問題を修正しました。プランは引き続き前払い式のパスで、自動更新はありません。

セキュリティガイドの本文がすべて表示されるようになり、ガイドとデイリー脅威ブリーフィングの日本語版を順次公開しています。

プラットフォーム全体のセキュリティ監査を実施し、検出された課題を修正しました。

設定されたパブリッシャー ID から生成する /ads.txt のエンドポイントを追加しました。これにより、認定販売者の記録がサイトの設定と食い違うことはなくなります。

ホームページを再構成し、見出しが説明文の下に埋もれず先頭に来るようにしたほか、モバイルのヘッダーをすっきりさせました。信頼性に関する記述の緑のマーカーを中立的なチェックマークに置き換え、色はセキュリティの深刻度を示す用途に限定しました。

スマートフォンの設定を、スキャンして登録するコードを中心に作り直しました。入力不要で、約 30 秒でセキュリティエージェントをインストールできます。独自のイベントワークフロー向けに、自動化とターミナルでの手順も引き続き利用できます。

彩度の高い色をセキュリティの検出結果に限定した、落ち着いたコントラストの高いデザインにインターフェースを刷新しました。すべての文字と操作部品の色が WCAG AA を満たし、監査レポートは白黒で印刷しても読みやすくなっています。

稼働中のアプリケーションのバージョンをフッター、ステータスページ、この変更履歴に表示するようにしたため、どのリリースを使っているかを確認できます。バージョンは、意図的にページのメタデータやレスポンスヘッダーには含めていません。