Pricing

Simple prices, shown in US dollars (US$) based on where you are. Safe Scan is free; the Deep Scan is a one-off authorized active scan; Security Care keeps your site monitored and protected every month.

Plans and prices

Safe Scan Free

US$0 non-intrusive

Authorization checkbox required. Read-only requests and DNS lookups.

  • HTTP security headers (CSP, HSTS, …)
  • TLS certificate & protocol
  • Cookie flags
  • Passive common-path exposure
  • Version disclosure vs. the latest critical CVEs we track
  • TLS chain vs. known compromised CAs
  • SPF / DMARC / DKIM
Run free Safe Scan

Deep / Active Scan One-off

US$45 one-off

Authorized active vulnerability scan: Safe baseline, multi-URL nuclei (critical→low), TLS/JS-secrets/CORS/subdomain modules, OWASP-mapped report. Optional nikto/ZAP/nmap when available. Automated — not a human pentest.

Report in your inbox within about 1 hour after you verify your domain (always within 24 hours).

  • Everything in the free Safe Scan
  • Domain ownership verification required before any active probe
  • Same-host URL discovery (robots.txt, sitemap, homepage links) fed to the scanner
  • nuclei community templates (critical→low; dos/fuzz/intrusive excluded; auto-updated daily)
  • Targeted second nuclei pass when WordPress/Drupal/Laravel/Next.js (etc.) is detected
  • Deep TLS check: protocol versions, cipher quality, cert chain / expiry, HSTS preload readiness
  • Public JavaScript secret scan (high-confidence patterns; values redacted in the report)
  • CORS Origin-reflection probe and deeper CSP / cookie analysis
  • Passive subdomain intel via Certificate Transparency (discovery only)
  • Optional nikto / ZAP / light nmap when those tools are installed
  • Checks for the latest critical CVEs we track (currently PHP2Shell and eMudhra compromised CAs)
  • TLS chain check against known compromised certificate authorities
  • Optional, included: code security review of your GitHub repository (read-only token; AI-assisted, source-only; each finding re-checked by a second model)
  • PDF + HTML report: executive summary, OWASP Top 10 mapping, fix-first list, scan inventory
  • Automated scanner probes only — not a manual penetration test
Order Deep Scan

Security Care Monthly subscription

US$35 per month

Continuous monitoring for your verified site: daily safe checks, regular deep scans, alerts when something new appears and a monthly security report.

  • A Safe Scan of your site every day
  • A Deep / Active Scan of your verified domain every week
  • Always up to date: scanner templates and our threat list refreshed every 24 hours
  • New CVEs covered as they appear (currently PHP2Shell and eMudhra compromised CAs)
  • An email alert when a new vulnerability or exposure shows up on your site
  • A monthly security report: what changed, what's fixed, what's still open
  • Optional, included: a monthly code security review of your GitHub repository (read-only token; AI-assisted, source-only)
  • Verify your domain once; we keep it on file for the subscription
  • Cancel any time
Start Security Care

Side by side

What you getSafe ScanDeep / Active ScanSecurity Care
Headers, TLS, cookies, DNS email records✓✓✓ every day
Latest critical CVEs & CA incidents we track (now: PHP2Shell and eMudhra compromised CAs)PassivePassive + templatesPassive + templates, re-checked
Active probes with nuclei (CVE → low; multi-URL + tech-targeted pass)–✓ once✓ every week
TLS depth, JS secret scan, CORS/CSP, subdomain intel–✓✓ with each deep
Templates & threat list updated daily–✓ at scan time✓ applied to your site every day
Optional code security review of your GitHub repository (read-only, AI-assisted, source only)–✓ once, if you connect a repo✓ monthly, if you connect a repo
Alert when a new vulnerability or exposure appears––✓ by email
Monthly security report (what changed, fixed, still open)––✓
Domain ownership verificationCheckboxDNS TXT or fileDNS TXT or file, once (kept on file)
ReportScore + fixesFull findings, critical → lowAlerts + monthly report + deep-scan reports
PriceUS$0US$45 one-offUS$35 per month

Want to see what a report looks like? Open a sample security report, made on our own site.

Also from Lordevo: SEO checks

Lordevo SEO runs a free one-page SEO scan in about a minute. The Full SEO Audit (US$25 one-off) crawls up to 50 pages and gives you a prioritised fix plan; Monthly SEO Care (US$35 a month) re-runs it every month.

Run the free SEO scanSample SEO audit reportSEO pricing

What each scan does

How the free Safe Scan works (animated explainer) Four-step animation. Step 1: you type your website address and tick the box confirming you are authorized to test it. Step 2: gentle, passive checks sweep your site: security headers, TLS certificate, cookie flags and DNS email records. Step 3: a safety score gauge fills up and recent threats are checked, including PHP2Shell (CVE-2026-109618 and CVE-2026-109619) and the compromised eMudhra certificate authorities. Step 4: you get your result, a low risk rating with a short list of fixes, or exactly what to fix. STEP 1 OF 4Enter your site and confirm you may test it Website address yourwebsite.com Scan I own this site or am authorized to have it tested Free · no sign-up · non-intrusive STEP 2 OF 4Gentle, passive checks. Nothing is attacked Security headersCSP, HSTS, X-FrameTLS certificatevalid · modern protocol!Cookie flags2 cookies to tightenDNS email recordsSPF · DMARC · DKIM Read-only requests and DNS lookups, like a normal visitor STEP 3 OF 4A safety score, plus the latest threats checked SAFETY SCORE 78 out of 100 PHP2ShellCVE-2026-109618 / -109619PHP version not exposedeMudhra CA incidentOct 2026 compromised intermediatesCertificate chain cleanExposed files.env, .git, backupsNothing found STEP 4 OF 4You’re safe, or you know exactly what to fix YOUR RESULT Risk levelLOW 2 quick fixes, in plain English Shareable report link Recent CVEs checked Want it tested harder? Deep Scan →

Free Safe Scan

US$0 · free

Passive checks of headers, TLS, cookies, DNS and recent-CVE surface. A safety score in about a minute, nothing attacked.

Run it free
How the paid Deep / Active Scan works (animated explainer) Five-step animation. Step 1: you prove you own the domain with a DNS TXT record or a small verification file. Step 2: you pay once on Stripe's secure checkout (US$45). Step 3: an active nuclei scan probes your site with a radar sweep, testing login, admin, API and exposed-file endpoints against auto-updated vulnerability templates. Step 4: you get detailed findings ranked critical, high, medium and low, each with a fix. Step 5: a padlock closes with a tick once the fixes are in. Compared with the free scan it adds active probes, CVE and misconfiguration templates and a full findings report. STEP 1 OF 5Prove you own the domain OPTION A · DNS TXT _lordevo-verify.yourwebsite.com TXT "lordevo-verify=7f3a…" Add one record at your DNS host or OPTION B · FILE /.well-known/lordevo-verify.txt lordevo-verify=7f3a… Upload one small text file Domain verified STEP 2 OF 5Pay once, securely on Stripe Secure checkout · Stripe Deep / Active Scan US$45one-off · no subscription •••• •••• •••• 4242 Pay Paid STEP 3 OF 5Active nuclei scan probes every corner NUCLEI · TEMPLATES UPDATED DAILY /loginok/adminreview/api/v1ok/.git/configexposedTLS + CVEsok STEP 4 OF 5Detailed findings, critical to low, with fixes FINDINGS BY SEVERITY Critical1High2Medium4Low6 HIGHExposed .git directoryFix: block /.git in your web serverMEDIUMNo Content-Security-PolicyFix: add a CSP header (example inside)INFOTemplate set & engine versionDated, so you know what was tested STEP 5 OF 5Fix, re-check and lock it down WHAT DEEP SCAN ADDS Active probes, not just a lookCVE & misconfiguration templatesFull findings report with fixesOwnership-verified and logged

Deep / Active Scan

US$45 · one-off

Ownership-verified multi-module scan: nuclei across discovered URLs, TLS & JS-secret checks, CORS/CSP depth, subdomain intel, and an OWASP-mapped fix-first report. Automated — not a human pentest.

Order Deep Scan
How Security Care keeps your site protected (animated explainer) Four-step animation. Step 1: you verify your domain once and subscribe monthly (US$35 a month); the verification is kept on file. Step 2: every day your site gets a fresh Safe Scan, and every week a Deep Scan, using scanner templates and a threat list that are refreshed every 24 hours, so new CVEs such as PHP2Shell and the eMudhra certificate incident are covered as they appear. Step 3: if something new shows up, you get a calm, clear email alert with what it is and how to fix it, and the next check confirms the fix. Step 4: every month you get a security report showing what changed, what was fixed and what is still open, so your site stays protected over time. STEP 1 OF 4Verify once, then subscribe monthly OWNERSHIP · ONE TIME _lordevo-verify.yourwebsite.com TXT "lordevo-verify=7f3a…" Domain verified Kept on file for your subscription Security Care US$35/ month Cancel any time Subscribe Active STEP 2 OF 4Checked every day, with today's threat list THIS WEEK MonTueWedThuFriSatSun Safe Scan every day + Deep / Active Scan every week UPDATED EVERY 24 H Scanner templatesNew CVE listPHP2Shell checkseMudhra CA list STEP 3 OF 4Something new? A calm, clear alert FROM HELLO@LORDEVO.COM New on yourwebsite.com: an exposed /.env file HIGH found today, not there yesterday What to doBlock /.env on the web server, rotate the keys. NEXT CHECK Fixed and confirmed STEP 4 OF 4A monthly report. Protected all month long YOUR MONTHLY SECURITY REPORT 30 daily checks, 4 deep scansWhat changed, what is fixedStill open, with clear fixesAlways-current threat coverage

Security Care

US$35 / month

Stay safe at all times. We keep watching your site after the first scan: a Safe Scan every day, a Deep Scan every week, and our checks updated every 24 hours, so new threats are covered as they appear.

  • Daily safe checks and weekly deep scans of your verified site
  • Always up to date: scanner templates and threat list refreshed daily
  • A friendly alert when something new appears, plus a monthly report
Start Security Care

How paying works

You pay securely on Stripe's checkout page: card for the Deep Scan, card for Security Care (billed monthly, cancel any time). We never see your card or bank details. You're charged in the currency shown here (US dollars (US$)). After payment you verify domain ownership (DNS TXT or a well-known file), then the scan starts automatically and we email the report, usually within about 1 hour of verification. If we cannot scan (blocks, verification fails permanently), we refund you.

Security Care billing

Security Care is US$35 a month, charged in US dollars (US$) and renewed automatically each month until you cancel. You verify your domain once when you subscribe and we keep that verification on file, so the weekly deep scans can run without asking you again. Cancel any time by emailing hello@lordevo.com: it stops before the next payment; the current month isn't refunded.

No guarantees that a clean scan means you can't be hacked. See our terms.