Is your website safe from attack?
Bro checks your website for the weak spots attackers look for, in about a minute, without attacking anything. Want a deeper test? The paid Deep Scan actively tests a site once you have shown it is yours.
Free Safe Scan: headers, TLS, cookies, passive path checks, DNS/email hygiene, the latest critical CVEs we track (currently PHP2Shell and eMudhra compromised CAs). No exploitation. 5 scans an hour. See privacy.
- No sign-up
- Nothing attacked
- Latest CVEs checked
Free Safe Scan, Deep Scan or Security Care?
The free scan looks at your site the way a careful visitor would. The Deep Scan, after you verify the domain, actively probes it the way an attacker's tools would, and tells you what to fix. Security Care keeps doing both for you, every day, with checks that are always up to date.
Free Safe Scan
US$0 · freePassive checks of headers, TLS, cookies, DNS and recent-CVE surface. A safety score in about a minute, nothing attacked.
Run it freeDeep / Active Scan
US$45 · one-offOwnership-verified multi-module scan: nuclei across discovered URLs, TLS & JS-secret checks, CORS/CSP depth, subdomain intel, and an OWASP-mapped fix-first report. Automated — not a human pentest.
Order Deep ScanSecurity Care
US$35 / monthStay safe at all times. We keep watching your site after the first scan: a Safe Scan every day, a Deep Scan every week, and our checks updated every 24 hours, so new threats are covered as they appear.
- Daily safe checks and weekly deep scans of your verified site
- Always up to date: scanner templates and threat list refreshed daily
- A friendly alert when something new appears, plus a monthly report
Start free. Go deeper when it matters. Stay protected all year.
Prices in US dollars (US$). Domain ownership verification is mandatory before any active probe.
Safe Scan Free
Authorization checkbox required. Read-only requests and DNS lookups.
- HTTP security headers (CSP, HSTS, …)
- TLS certificate & protocol
- Cookie flags
- Passive common-path exposure
- Version disclosure vs. the latest critical CVEs we track
- TLS chain vs. known compromised CAs
- SPF / DMARC / DKIM
Deep / Active Scan One-off
Authorized active vulnerability scan: Safe baseline, multi-URL nuclei (critical→low), TLS/JS-secrets/CORS/subdomain modules, OWASP-mapped report. Optional nikto/ZAP/nmap when available. Automated — not a human pentest.
Report in your inbox within about 1 hour after you verify your domain (always within 24 hours).
- Everything in the free Safe Scan
- Domain ownership verification required before any active probe
- Same-host URL discovery (robots.txt, sitemap, homepage links) fed to the scanner
- nuclei community templates (critical→low; dos/fuzz/intrusive excluded; auto-updated daily)
- Targeted second nuclei pass when WordPress/Drupal/Laravel/Next.js (etc.) is detected
- Deep TLS check: protocol versions, cipher quality, cert chain / expiry, HSTS preload readiness
- Public JavaScript secret scan (high-confidence patterns; values redacted in the report)
- CORS Origin-reflection probe and deeper CSP / cookie analysis
- Passive subdomain intel via Certificate Transparency (discovery only)
- Optional nikto / ZAP / light nmap when those tools are installed
- Checks for the latest critical CVEs we track (currently PHP2Shell and eMudhra compromised CAs)
- TLS chain check against known compromised certificate authorities
- Optional, included: code security review of your GitHub repository (read-only token; AI-assisted, source-only; each finding re-checked by a second model)
- PDF + HTML report: executive summary, OWASP Top 10 mapping, fix-first list, scan inventory
- Automated scanner probes only — not a manual penetration test
Security Care Monthly subscription
Continuous monitoring for your verified site: daily safe checks, regular deep scans, alerts when something new appears and a monthly security report.
- A Safe Scan of your site every day
- A Deep / Active Scan of your verified domain every week
- Always up to date: scanner templates and our threat list refreshed every 24 hours
- New CVEs covered as they appear (currently PHP2Shell and eMudhra compromised CAs)
- An email alert when a new vulnerability or exposure shows up on your site
- A monthly security report: what changed, what's fixed, what's still open
- Optional, included: a monthly code security review of your GitHub repository (read-only token; AI-assisted, source-only)
- Verify your domain once; we keep it on file for the subscription
- Cancel any time
Side by side
| What you get | Safe Scan | Deep / Active Scan | Security Care |
|---|---|---|---|
| Headers, TLS, cookies, DNS email records | ✓ | ✓ | ✓ every day |
| Latest critical CVEs & CA incidents we track (now: PHP2Shell and eMudhra compromised CAs) | Passive | Passive + templates | Passive + templates, re-checked |
| Active probes with nuclei (CVE → low; multi-URL + tech-targeted pass) | – | ✓ once | ✓ every week |
| TLS depth, JS secret scan, CORS/CSP, subdomain intel | – | ✓ | ✓ with each deep |
| Templates & threat list updated daily | – | ✓ at scan time | ✓ applied to your site every day |
| Optional code security review of your GitHub repository (read-only, AI-assisted, source only) | – | ✓ once, if you connect a repo | ✓ monthly, if you connect a repo |
| Alert when a new vulnerability or exposure appears | – | – | ✓ by email |
| Monthly security report (what changed, fixed, still open) | – | – | ✓ |
| Domain ownership verification | Checkbox | DNS TXT or file | DNS TXT or file, once (kept on file) |
| Report | Score + fixes | Full findings, critical → low | Alerts + monthly report + deep-scan reports |
| Price | US$0 | US$45 one-off | US$35 per month |
You pay securely on Stripe's checkout page: card for the Deep Scan, card for Security Care (billed monthly, cancel any time). We never see your card or bank details. See a sample security report.
Also from Lordevo: SEO checks
Lordevo SEO runs a free one-page SEO scan in about a minute. The Full SEO Audit (US$25 one-off) crawls up to 50 pages and gives you a prioritised fix plan; Monthly SEO Care (US$35 a month) re-runs it every month.
What the free scan checks
Headers & TLS
CSP, HSTS, framing and other security headers, plus your certificate, protocol and chain.
Cookies & exposed files
Secure / HttpOnly / SameSite flags and a short, passive check for files that should never be public.
Email security
SPF, DMARC and DKIM records that stop others sending email as your domain.
Recent threats
Advertised software versions against the latest critical CVEs we track (right now PHP2Shell and eMudhra compromised CAs), and your TLS chain against known compromised CAs. See current threats.
Current threats we check for
Our threat list updates every day from our own knowledge base and CISA's Known Exploited Vulnerabilities catalog, and deep scans use nuclei templates that also update daily. Last refreshed 25 Oct 2026, 01:39 UTC · knowledge base 2026-10-25.1 · CISA KEV catalog 2026.10.23.
PHP2Shell (CVE-2026-109618 / CVE-2026-109619)
CVE-2026-109618 · CVE-2026-109619
Critical unauthenticated remote code execution in PHP web runtimes (OOM-handling memory corruption and stale global state). Disclosed October 2026.
Status: Fix available.
Read the advisoryeMudhra compromised intermediate CAs (October 2026)
Eight eMudhra Global TLS intermediate CA keys were recoverable (weak entropy). Browsers blocked them. Sites chaining through them need a new certificate.
Status: Mitigated.
Read the advisoryFortinet Multiple Products: CVE-2025-61624
FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.
Status: Actively exploited (in CISA's Known Exploited Vulnerabilities catalog since 16 Oct 2026).
Details & how to checkCareful by design
Security testing should never be a risk in itself. Here is what you can count on.
Authorization first
Every scan needs your confirmation; active scans need proof you own the domain.
No exploitation
Automated scanner probes only, destructive templates excluded. No brute force, no flooding.
Privacy first
No tracking cookies, no third-party analytics, IP addresses never written to disk.
Safe payments
You pay on Stripe's own checkout page, in your local currency.
Questions
Is the Safe Scan really free and harmless?
Yes. No account, no card. It only makes normal read-only requests and DNS lookups, like a visitor would, and is limited to 5 scans an hour per visitor.
What does "active" mean in the Deep Scan?
Automated vulnerability scanners send crafted requests to detect known issues. We don't run exploits against your data, brute-force logins or flood your site, and destructive templates are excluded. Still, only scan systems you're allowed to test.
Why do I need to verify my domain?
Because active scanning a site you don't control is illegal in most places. You add a DNS TXT record or a small file; the scan won't start until that check passes.
How do I pay?
Fill in the order form and you go to Stripe's secure checkout, priced in US dollars (US$) (card). If we can't complete a verified scan, we refund you.
What does Security Care add?
Websites change and new vulnerabilities are published every week. Security Care (US$35 a month) re-checks your verified site every day with a Safe Scan and every week with a Deep Scan, using scanner templates and a threat list we refresh every 24 hours. If something new appears, we email you straight away with what it is and how to fix it, and you get a monthly security report. You verify your domain once; cancel any time.
Is this a manual penetration test?
No. It's automated scanning, clearly reported. It's a fast, affordable way to catch known issues, not a replacement for a human-led pentest.
Check your site in a minute
Free and non-intrusive. Then decide if you need the Deep Scan.