Simple, transparent pricing

Yes. The one-time domain scan on the home page requires no signup, no credit card, and no account. You get an instant grade and a downloadable PDF report.

SSL/TLS (certificate validity plus the protocol and cipher your server negotiates), HTTP security headers, accidentally exposed files like .env and .git, cookie security flags (Secure, HttpOnly, SameSite), SPF/DMARC/DKIM email spoofing protection, IP blacklist status, and — for WordPress, WooCommerce, and Shopify sites — exposed admin logins and outdated plugins. We also report security.txt, CAA, and DNSSEC as informational signals; those don't affect your grade since most sites don't have them configured.

If the plan you choose includes a free trial, it may require a payment method up front and converts to the paid subscription automatically unless you cancel before the trial ends. You'll see the full checkout details, including whether a trial applies, before anything is confirmed.

Yes, from your account at any time. When you cancel, you keep full access through the end of your current billing period — there's no immediate cutoff.

Both include daily re-scans, uptime monitoring, full scan history with before/after comparison, email alerts on regressions, and an automatic monthly PDF report. Starter covers up to 5 monitored domains for $9/month; Pro covers unlimited domains for $29/month with no per-domain fee, and adds Slack alerts alongside email. You can upgrade from your account anytime — domains you already added are kept, you just can't add more past your plan's limit until you upgrade or free up a slot.

Just what's needed to run the service: your account email (via our authentication provider, Clerk), the domains you add, and scan results about those domains. We don't sell data or use advertising trackers — see our Privacy Policy for the full breakdown.

Yes. Upload a package-lock.json, yarn.lock, requirements.txt, or composer.lock and every dependency is checked against OSV.dev's public vulnerability database — no signup required, and the file itself is never stored, written to disk, or logged.

The free scan is a one-time snapshot. Starter and Pro both add continuous re-scanning on the schedule you choose, uptime monitoring that alerts you if a site stops responding, full scan history with before/after comparison, email alerts when something regresses — a grade drop or a new blacklist hit — and an automatic monthly PDF report emailed to you.

Every monitored domain is checked every few minutes. A single failed check isn't enough to alert you — we require two consecutive failures before reporting a domain as down, so a momentary blip doesn't wake you up, and we let you know again once it recovers. You can switch uptime checks off per-domain from your dashboard if a particular host doesn't respond well to automated requests. It's a lightweight reachability check, not a replacement for a dedicated status-page or on-call product.

No, and we'd rather say so plainly than imply otherwise. Every check is automated and best-effort: scans can produce false positives or false negatives, an uptime check can occasionally misreport a healthy site, a short outage can fall between checks, and an email or Slack message can fail to deliver. Treat results and alerts as a useful signal, not a guarantee — and don't rely on them as the only safeguard for anything critical. See our Terms of Service for the full disclaimer.

Yes. Every monitored domain on Starter or Pro automatically gets a PDF security report emailed to its owner once a month, built from the most recent scan — on top of the on-demand download available from any scan result.