How it works

Check your website with a free, passive Safe Scan, or a paid Deep / Active Scan once you have proved you own the domain, or keep it protected every day with Security Care.

The three ways to check your site

How the free Safe Scan works (animated explainer) Four-step animation. Step 1: you type your website address and tick the box confirming you are authorized to test it. Step 2: gentle, passive checks sweep your site: security headers, TLS certificate, cookie flags and DNS email records. Step 3: a safety score gauge fills up and recent threats are checked, including PHP2Shell (CVE-2026-109618 and CVE-2026-109619) and the compromised eMudhra certificate authorities. Step 4: you get your result, a low risk rating with a short list of fixes, or exactly what to fix. STEP 1 OF 4Enter your site and confirm you may test it Website address yourwebsite.com Scan I own this site or am authorized to have it tested Free · no sign-up · non-intrusive STEP 2 OF 4Gentle, passive checks. Nothing is attacked Security headersCSP, HSTS, X-FrameTLS certificatevalid · modern protocol!Cookie flags2 cookies to tightenDNS email recordsSPF · DMARC · DKIM Read-only requests and DNS lookups, like a normal visitor STEP 3 OF 4A safety score, plus the latest threats checked SAFETY SCORE 78 out of 100 PHP2ShellCVE-2026-109618 / -109619PHP version not exposedeMudhra CA incidentOct 2026 compromised intermediatesCertificate chain cleanExposed files.env, .git, backupsNothing found STEP 4 OF 4You’re safe, or you know exactly what to fix YOUR RESULT Risk levelLOW 2 quick fixes, in plain English Shareable report link Recent CVEs checked Want it tested harder? Deep Scan →

Free Safe Scan

US$0 · free

Passive checks of headers, TLS, cookies, DNS and recent-CVE surface. A safety score in about a minute, nothing attacked.

Run it free
How the paid Deep / Active Scan works (animated explainer) Five-step animation. Step 1: you prove you own the domain with a DNS TXT record or a small verification file. Step 2: you pay once on Stripe's secure checkout (US$45). Step 3: an active nuclei scan probes your site with a radar sweep, testing login, admin, API and exposed-file endpoints against auto-updated vulnerability templates. Step 4: you get detailed findings ranked critical, high, medium and low, each with a fix. Step 5: a padlock closes with a tick once the fixes are in. Compared with the free scan it adds active probes, CVE and misconfiguration templates and a full findings report. STEP 1 OF 5Prove you own the domain OPTION A · DNS TXT _lordevo-verify.yourwebsite.com TXT "lordevo-verify=7f3a…" Add one record at your DNS host or OPTION B · FILE /.well-known/lordevo-verify.txt lordevo-verify=7f3a… Upload one small text file Domain verified STEP 2 OF 5Pay once, securely on Stripe Secure checkout · Stripe Deep / Active Scan US$45one-off · no subscription •••• •••• •••• 4242 Pay Paid STEP 3 OF 5Active nuclei scan probes every corner NUCLEI · TEMPLATES UPDATED DAILY /loginok/adminreview/api/v1ok/.git/configexposedTLS + CVEsok STEP 4 OF 5Detailed findings, critical to low, with fixes FINDINGS BY SEVERITY Critical1High2Medium4Low6 HIGHExposed .git directoryFix: block /.git in your web serverMEDIUMNo Content-Security-PolicyFix: add a CSP header (example inside)INFOTemplate set & engine versionDated, so you know what was tested STEP 5 OF 5Fix, re-check and lock it down WHAT DEEP SCAN ADDS Active probes, not just a lookCVE & misconfiguration templatesFull findings report with fixesOwnership-verified and logged

Deep / Active Scan

US$45 · one-off

Ownership-verified multi-module scan: nuclei across discovered URLs, TLS & JS-secret checks, CORS/CSP depth, subdomain intel, and an OWASP-mapped fix-first report. Automated — not a human pentest.

Order Deep Scan
How Security Care keeps your site protected (animated explainer) Four-step animation. Step 1: you verify your domain once and subscribe monthly (US$35 a month); the verification is kept on file. Step 2: every day your site gets a fresh Safe Scan, and every week a Deep Scan, using scanner templates and a threat list that are refreshed every 24 hours, so new CVEs such as PHP2Shell and the eMudhra certificate incident are covered as they appear. Step 3: if something new shows up, you get a calm, clear email alert with what it is and how to fix it, and the next check confirms the fix. Step 4: every month you get a security report showing what changed, what was fixed and what is still open, so your site stays protected over time. STEP 1 OF 4Verify once, then subscribe monthly OWNERSHIP · ONE TIME _lordevo-verify.yourwebsite.com TXT "lordevo-verify=7f3a…" Domain verified Kept on file for your subscription Security Care US$35/ month Cancel any time Subscribe Active STEP 2 OF 4Checked every day, with today's threat list THIS WEEK MonTueWedThuFriSatSun Safe Scan every day + Deep / Active Scan every week UPDATED EVERY 24 H Scanner templatesNew CVE listPHP2Shell checkseMudhra CA list STEP 3 OF 4Something new? A calm, clear alert FROM HELLO@LORDEVO.COM New on yourwebsite.com: an exposed /.env file HIGH found today, not there yesterday What to doBlock /.env on the web server, rotate the keys. NEXT CHECK Fixed and confirmed STEP 4 OF 4A monthly report. Protected all month long YOUR MONTHLY SECURITY REPORT 30 daily checks, 4 deep scansWhat changed, what is fixedStill open, with clear fixesAlways-current threat coverage

Security Care

US$35 / month

Stay safe at all times. We keep watching your site after the first scan: a Safe Scan every day, a Deep Scan every week, and our checks updated every 24 hours, so new threats are covered as they appear.

  • Daily safe checks and weekly deep scans of your verified site
  • Always up to date: scanner templates and threat list refreshed daily
  • A friendly alert when something new appears, plus a monthly report
Start Security Care

From your address to a locked-down site

Step 1: enter your website addressAn address is typed into the scan box and the scan button is pressed. yourwebsite.com

Enter your site

Type the address and confirm you own it or are authorized to test it.

Step 2: a safe security scanA radar sweeps around a shield and picks up findings as coloured dots.

Safe Scan

Gentle, read-only checks: headers, TLS, cookies, exposed paths, DNS and known-CVE surface.

Step 3: a clear risk reportBars for critical, high, medium and low findings grow to show how many of each were found. FINDINGS CriticalHighMediumLow

Clear risk report

A score and every finding ranked, explained in plain English with a fix.

Step 4: fix and lock it downA padlock closes and a tick appears once the security fixes are applied.

Deep Scan & lock down

Verify your domain, and the paid active scan probes deeper so you can close the gaps.

Safe Scan (free)

  1. You enter a public URL and confirm you are authorized.
  2. Bro fetches the page (SSRF-safe), checks TLS, headers, cookies, a short list of sensitive paths via GET only, DNS email records, and known-CVE surface from advertised versions.
  3. You get a scored HTML report. No account required.

We check against the latest critical CVEs we track, currently PHP2Shell and eMudhra compromised CAs. Our list updates every day: see all current threats.

Deep / Active Scan (paid)

  1. You order and pay.
  2. We give you a unique token. Publish it as a DNS TXT at _lordevo-verify.yourdomain or as a file at /.well-known/lordevo-verify.txt.
  3. Open /verify (or we check from admin). The scan will not start until verification succeeds.
  4. We run the Safe Scan baseline, lightly discover same-host URLs (robots/sitemap/links), then nuclei (critical→low; dos/fuzz/intrusive excluded) across that URL list — plus a targeted pass when a CMS/framework is detected. Deep-only modules then check TLS depth, public JS for secrets (redacted), CORS/CSP, open redirects, and passive subdomain intel. Optional nikto / ZAP / light nmap when installed.
  5. You receive the report by email (PDF plus an HTML copy), usually within about 1 hour of verification: executive summary with fix-first items, OWASP Top 10 mapping, scan inventory, severities, remediation, nuclei version/template date, and recent-threat coverage. Automated scanners only — not a human penetration test.

Security Care (monthly)

  1. You subscribe (US$35 a month) and verify your domain once, the same DNS TXT or file check as the Deep Scan. We keep the verification on file for the subscription.
  2. Every 24 hours we refresh our knowledge base: nuclei templates, our list of recent CVEs (such as PHP2Shell) and incident data (such as the eMudhra CA list), plus the public list of vulnerabilities known to be exploited.
  3. Every day your site gets a Safe Scan; every week, a Deep / Active Scan (only on the verified domain).
  4. We compare each result with the last one. If a new vulnerability or exposure appears, we email you a short, plain-English alert with the fix.
  5. Once a month you get a security report: what changed, what was fixed, and what is still open.

Optional: code security review (included)

With a Deep Scan or Security Care you can also connect one GitHub repository, at no extra cost. It is optional and separate from the domain check.

  1. After payment, open the code review page from your order (or /code-review) and paste a GitHub fine-grained token limited to that one repository with Contents: Read-only. We only read; we never push, open pull requests or change settings. The token must come from an account that maintains the repository, so nobody can order a review of someone else's code.
  2. We download one commit, check it for committed secrets on our own server, then an AI model (Anthropic Claude or OpenAI Codex) reviews the most security-relevant files for flaws that cross a real trust boundary: injection, broken access control, auth and session bugs, SSRF, unsafe file handling, crypto and secret mistakes, risky CI workflows. A different model then tries to disprove each finding, and we check every cited file and line exists.
  3. Findings are added to your report with severity, the exact file and line, and the smallest fix. Leads that depend on something we can't see in the code (your hosting, a proxy) are listed separately without a severity.

Be clear on what it is: a single-pass, source-only review. We do not build, run or attack your code, larger repositories are only partly covered (the report lists every file reviewed and not reviewed), and AI reviews can miss issues or be wrong. Reviews run in a queue, so connect the repository before you verify your domain if you want it in the same report; otherwise it follows separately. The method is adapted from Cloudflare's open-source security-audit skill (MIT licence); Lordevo is not affiliated with Cloudflare. For one-off orders we delete your token as soon as the review finishes; you can disconnect at any time.

What “active” means

Automated vulnerability scanners send crafted requests to detect known issues. We do not run exploits against your data, brute-force logins, or flood your site. Still, scanners can occasionally trigger application errors, so only scan systems you are allowed to test.

Our scanner identity

Requests identify as LordevoPentestBot/1.0 (+https://pentest.lordevo.com/how-it-works).

Run free Safe Scan Order Deep Scan Start Security Care