What has changed.

NeoShield Security Agent for Pro and MSP / Team: on a scan report, ask for an explanation of a finding, a remediation plan, a configuration draft or review, a rollback plan, a verification checklist, a client summary, a developer ticket or a comparison with the previous report. Answers are drafts grounded in the scan evidence, labelled by source, in English or Japanese. Secrets and email addresses are removed before anything is sent to the Claude API, nothing is applied automatically, and only a Verify Fix rescan can mark a finding resolved. Monthly and daily request limits apply.

Free scans now show the name, severity, basic evidence and confidence of every critical, high and medium finding; the full fix steps, exports and verification stay in paid plans. Reports separate confirmed findings from items that need review, use the label "Observed configuration score", and give fix priorities from P0 (Immediate action) to P4. DNSSEC is reported only from the DS and DNSKEY records, MTA-STS and TLS-RPT are no longer raised for domains that receive no email, and COEP is suggested only where it applies. New navigation with Free Tools, Academy and a separate NeoShield Labs area for experimental tools, a homepage that starts with the scan, and Team marked Early Access. Scan authorization records now store the Terms version.

Rebuilt client PDF report: a clickable contents page, the score breakdown showing the points each confirmed finding removed, coverage and confidence, confirmed findings kept apart from items to review, fix priority (P0 to P4) with a remediation roadmap, a plain-language explanation for the client on common findings, Deep Scan module results, the authorization record, a standards mapping appendix and version details. Everything printed comes from the stored scan.

Clearer website copy for agencies: a new homepage headline, a comparison with free security checkers, profiles of who NeoShield is for, product screenshots from the sample report, a planned Monthly Security Summary shown with example data, a plain-language Refund Policy page, a Trust Center summary of how NeoShield itself is secured, and finding explanations for developers and clients on the methodology page. The sample report now rates a missing HSTS header as High, as the scanner does.

Repositioned for freelance developers and small web agencies: the homepage leads with the complete sample report, explains what is and is not checked, who the service is (and is not) for, and who runs it. Navigation is simpler: Product, Sample Report, Pricing, Resources and Trust Center; the tool library and Security Lab now sit under Resources.

Free reports now show the title, severity, affected host and a short explanation of every high and critical finding. Evidence and fixes for those findings remain part of Pro.

Pricing puts the website-reporting comparison first (users, websites and their scope, scans, monitoring frequency, exports, what happens after expiry, support) and adds answers on the operator, SLA, white-labelling, manual review and penetration testing. The MSP / Team website limit is stated the same way everywhere: up to 25 monitored websites per user, and 25 per workspace for the client list and Security Center.

Trust Center and Security pages state that NeoShield is solo-operated, describe backups, monitoring, incident communication and what happens when the operator is unavailable, and no longer claim restore testing that has not been evidenced. New Methodology page.

Advertising (after consent) is limited to blog articles, as the Cookie Policy states; product, pricing and scanner pages never load it.

Security Center for every plan: Free accounts now get a Security Center for their own website with events, cookie-free visitor analytics, security-header checks and uptime monitoring. Pro adds blocking, file integrity, tripwires, cases, threat intelligence and AI analysis; MSP / Team adds the shared workspace tools.

Website agent 2.0 and a WordPress plugin: report attacks, failed logins, administrator and plugin changes, and changed code files to your Security Center. Blocking is optional per website (Pro and MSP / Team) and never applies to IPs on your allowlist.

The agent download on the Websites page delivered an empty file; it now downloads correctly, and agent events are stored for every website.

New homepage: start a scan straight from the first screen, see a real sample report page, and follow one finding from evidence to a platform-specific fix and the rescan that confirms it. Plans, scope limits and trust commitments are shown plainly, in English and Japanese.

Clearer menus: Security Tools now opens as four labelled columns with nothing hidden behind a scrollbar, and a new Resources menu puts the blog, manual, support and contact pages in plain view. Menu labels no longer wrap onto two lines on laptop-width screens, and the header Scan Free button text is easier to read.

Release emails: administrators can send a bilingual release notice to customers in controlled batches, starting with a small test group. People who unsubscribed, bounced addresses, test accounts, duplicate mailboxes and accounts being deleted are never emailed.

Structured data now matches what each page shows: Japanese pages carry Japanese FAQ markup, and manual pages no longer declare section lists as FAQs. Signed-out visitors reach the sign-in page in one redirect instead of two.

When a Deep Scan is skipped because a domain is not verified, you can now verify the domain right from the scan result (DNS record or file) and check it in one click. Platform administrators can Deep Scan the platform's own domain.

Team workspaces now have roles: Administrator, Scan operator, Analyst, Auditor and Viewer. The workspace administrator assigns them on the Team page, and each action in the scanner checks the role on the server.

Accepting a risk now needs a written reason, a named owner and an expiry date no more than a year away. When it expires, the finding reopens on the next scan. Marking a false positive needs a note.

Finding status changes are recorded in a tamper-evident log, and the administrator audit log now protects every field of each entry.

Sign-in codes: wrong guesses sent at the same moment are now counted one by one, so the five-attempt limit holds under load.

Scan reports no longer keep link tokens, session values or similar secrets that a scanned site placed in its redirects or pages. Older saved reports are cleaned when opened or exported.

Background scans are shared fairly between accounts, with up to 20 queued or running scans per account. Failed background scans show a reference number instead of internal error text.

Scanner safety: every request the scanner and tools make now goes through one hardened network layer that only reaches public addresses, re-checks each redirect, and limits size, time and number of requests per scan.

The Deep Scan, background scans and scheduled monitoring now run only on domains you have verified (DNS record or a file under /.well-known/). On other domains the standard passive scan runs and the report says the Deep Scan was skipped.

Every scan report now records why the scan was allowed (verified domain, written exception or your confirmation), its scope and its request budget.

The common-ports page is now a reference list; the live check of this server's own ports is limited to administrators.

The free security tools now run right on their own page: type a URL, token, IP or CVE and get the result below, no extra click.

Deeper results in seven of the most-used tools: the Security Header Checker reviews your CSP directive by directive and each cookie, and gives copy-paste fixes for nginx, Apache, IIS, Cloudflare and PHP.

The JWT auditor warns when a token is still signed with a sample secret from a library tutorial; the phishing checker spots look-alike domains, open-redirect links and recipient email hidden in a URL.

The CVE lookup now gives one patch-priority answer from NVD severity, the CISA exploited-vulnerabilities list and FIRST EPSS exploit probability.

Every tool result can be downloaded as JSON or CSV, printed or saved as PDF, and — when you are signed in — saved to your history for 90 days or shared with a private link.

Cookie choices: analytics and advertising now load only after you accept them, with separate switches and equal Accept and Reject buttons. Change your choice any time from "Cookie settings" in the footer.

New Account page: see where you are signed in, sign out other sessions, download your data, and request account deletion.

Sign-in hardening: sign-in codes are stored with a keyed hash, repeated wrong codes are limited, and sessions end 12 hours after sign-in.

Scheduled monitoring now requires proof that you control the domain (DNS record or verification file). Existing schedules keep running until 2026-11-30 while you verify.

Stronger protection for tools that fetch web addresses, safer CSV exports, and team invitation links that work once and need a confirmation click.

The status page now reports each component from real checks, with last-check times, incident history and a machine-readable feed for uptime monitors.

Privacy, Security, Cookie Policy, Trust Center and Responsible Disclosure pages rewritten to describe only what the service actually does, with a full cookie and subprocessor list.

Full Japanese support: every page, tool result and legal page is available in Japanese, AI tools answer Japanese visitors in Japanese, and tools can be searched with Japanese keywords.

The most-used free tools now sit at the top of the home page, and the menu is organised by task.

Fixed an issue that stopped some visitors from reaching the Stripe checkout page. Plans remain prepaid passes with no automatic renewal.

The security guides now show their full article text, and Japanese editions of the guides and the Daily Threat Briefing are being published.

Completed a platform-wide security audit and fixed the issues it found.

Added an /ads.txt endpoint generated from the configured publisher ID, so the authorised-sellers record cannot drift out of sync with the site configuration.

Rearranged the homepage so the headline leads instead of sitting below a paragraph of description, and tightened the mobile header. Replaced the green marker on trust statements with a neutral check, reserving colour for security severity.

Rebuilt phone setup around a scan-to-enrol code that installs the security agent in about thirty seconds with no typing. Automation and terminal instructions remain available for custom event workflows.

Refreshed the interface with a calmer, higher-contrast design in which saturated colour is reserved for security findings. Every text and control colour now meets WCAG AA, and audit reports print legibly in black and white.

Published the running application version on the footer, status page, and this changelog, so you can confirm which release you are using. The version is deliberately not exposed in page metadata or response headers.