SiteSentry
A website security grade from A to F in 30 seconds, with a fix for every finding.
Most company websites miss basic protections: security headers, modern TLS, email anti-spoofing records, up-to-date JavaScript libraries, and too often they leak .git folders, .env files or database dumps. SiteSentry checks all of it, grades the site and explains each fix in plain words. The quick scan is free for any site and needs no signup; deep scans for leaked files run on verified sites.
- Stage
- Live beta, free
- Launch market
- Danish SMB websites and web agencies
- Revenue
- Monthly subscription, agency plan
- Price
- Planned 490 to 1.990 kr a month
- Buyer
- Website owners, web agencies, IT partners
- Stack
- PHP · SQLite · OSV.dev
The problem
- Website owners cannot judge if their agency built the site securely.
- Phishing in a company's name works because SPF and DMARC are missing or set to monitor only.
- Leaked .git and .env files hand attackers source code and passwords; we found one on our own site.
The product
SiteSentry loads the site like a browser and checks the HTTP to HTTPS redirect, certificate trust and expiry, TLS 1.0 to 1.3, HSTS, CSP, clickjacking protection and other headers, cookie flags, mixed content, SPF, DMARC and CAA, and JavaScript and WordPress versions against OSV and NVD. Deep scans of verified sites probe 16 known leak paths with soft-404 detection and check for directory listing.
- Type a website address on the homepage; a quick scan runs at once.
- Read the grade and the fix for each finding.
- Create a free account to save sites and scan again.
- Verify ownership to unlock deep scans and weekly checks.
- Send the share link or PDF to the web agency.
Who pays and why
Business model
| Revenue line | Price | Notes |
|---|---|---|
| Free | 0 kr | Quick scans of any site, share links. |
| Business | 490 kr a month (planned) | 25 sites, deep scans, weekly monitoring and alerts. |
| Agency | 1.990 kr a month (planned) | Unlimited client sites, white-label reports, lead form widget. |
Market and targets
Free header checkers exist, but none combine headers, TLS, email spoofing, outdated code and leaked files in one Danish-priced product with monitoring. Web agencies are a strong channel: every agency has dozens to hundreds of client sites.
Targets and prices are planning assumptions. Payments are not switched on yet.
Go-to-market
Free scanner
- Free quick scan live (done)
- Danish language version
- SEO pages per check
Agencies
- Agency plan with white-label PDF
- Embeddable scan widget that creates leads
- Payments
Monitoring
- Certificate expiry and header regression alerts
- Uptime ping
- Integrations with Slack and email
Channels
| Free scans and SEO | People search for website security checks. |
|---|---|
| Web agencies | Agencies resell monitoring to their clients. |
| PortWarden and PatchPilot | Cross-sell inside the same login. |
Competition
| Alternative today | Why we win |
|---|---|
| Free header checkers | Good single checks, no history or leaked-file probing. |
| Enterprise DAST tools | Deep but expensive and complex. |
| WordPress security plugins | Only WordPress, and run inside the site itself. |
What we measure
- Free scans per week and signup rate
- Sites monitored per customer
- Findings fixed between scans
- Agency accounts
Status and roadmap
- HTTPS, redirect, certificate and TLS 1.0 to 1.3 checks
- Header, cookie, CORS and mixed content grading
- SPF, DMARC and CAA checks
- JavaScript library and WordPress CVE matching
- Deep leaked-file probing with soft-404 detection
- One login across PortWarden, SiteSentry and PatchPilot
- Ownership proof by DNS TXT or /.well-known file before intrusive scans
- Queued scan workers, live progress, A to F grading with a 100-point score
- Share links, JSON export, print-to-PDF reports, new / fixed diff against the previous scan
- Scheduled daily or weekly rescans, daily refresh of the CISA KEV catalogue
- Installable PWA, demo account, rate limits and private-network blocking
- Danish interface
- Email alerts on new findings
- White-label agency PDF
- Payments and plans
Risks
| Risk | How we handle it |
|---|---|
| Passive checks miss deeper flaws | The report says so; PortWarden and a pen-test service cover more. |
| Abuse of deep probing | Deep scans require ownership proof. |
| Low willingness to pay for free checks | Monitoring, alerts and agency features are the paid value. |
Want a product like this?
We build version one of products like SiteSentry from about $3,000: web app, admin panel, mobile app and API, live on your own domain. Then we can host and maintain it for $500 a month.