For MSPs and Web Agencies
Website security scanner for MSPs and web agencies
Check the public security configuration of the client websites you manage, explain the risks in business terms and hand developers the exact configuration change, without running intrusive tests.
Built around client work
- Confirm authorization for each website before it is scanned.
- Findings are ordered by severity and show the affected URL and the evidence observed.
- Each finding explains why it matters and its potential business impact.
- Configuration examples for Nginx, Apache HTTP Server, Microsoft IIS, Cloudflare, WordPress and AWS CloudFront where they apply.
What is checked
HTTPS and the TLS certificate, HTTP to HTTPS redirects, security headers (HSTS, Content-Security-Policy, frame protection, nosniff, Referrer-Policy, Permissions-Policy), cookie flags, server software disclosure, commonly exposed files, SPF, DMARC and security.txt.
What it is not
It is not a penetration test. It does not exploit vulnerabilities, log in, brute-force or fuzz. Authenticated areas and application logic need separate, authorized testing.
From scan to client report
Pro exports each report as PDF or CSV, keeps scan history, verifies fixes with a rescan and monitors up to five websites on a schedule. MSP / Team includes 5 users. Each user can monitor up to 25 websites; the shared client list and Security Center hold up to 25 websites per workspace. Separate client workspaces and agency-branded reports are planned.
Frequently asked questions
How many client websites can I monitor?
Free covers one website with one manual scan a month and no monitoring. Pro monitors up to 5 websites. MSP / Team includes 5 users. Each user can monitor up to 25 websites; the shared client list and Security Center hold up to 25 websites per workspace.
Will the scan disrupt a client website?
It sends a small number of ordinary requests, similar to a visitor loading a few pages, and reads DNS records. It does not send attack payloads.