Website security scanner
Your website security grade, A to F, in 30 seconds.
SiteSentry checks what attackers and auditors look at first: HTTPS and certificate, TLS versions, security headers, cookies, email spoofing protection, outdated JavaScript and CMS versions, and in a deep scan, leaked files like .git, .env and database dumps.
Quick scans are passive: we only load what any browser would. No signup needed.
What SiteSentry checks
HTTPS and TLS
Redirects, certificate trust and expiry, TLS 1.0 / 1.1 / 1.2 / 1.3 support.
Security headers
HSTS, Content-Security-Policy, clickjacking, nosniff, Referrer-Policy, Permissions-Policy, CORS.
Cookies
Secure, HttpOnly and SameSite flags on every cookie the site sets.
Email spoofing
SPF, DMARC and CAA records, so nobody can send phishing in your name.
Outdated code
jQuery, Bootstrap, Angular, lodash and WordPress versions checked against known vulnerabilities.
Leaked files (deep)
.git, .env, SQL dumps, config backups, phpinfo, server-status, directory listing, WordPress user enumeration.
We ran SiteSentry on our own site first. It found our .git folder was public. Fixed in two minutes.
Three steps
- Add your domain or IP. Quick scans need nothing more.
- Scan. Results in 30 seconds to 5 minutes, graded A to F with a plain-English fix for every finding.
- Schedule daily or weekly rescans and share a read-only report link with your developer or auditor.
Pricing
Business
490 kr/month
- 25 assets, daily scheduled scans
- Deep scans and leaked-file probing
- Unlimited PatchPilot agents
- "New since last scan" alerts
Partner
1.990 kr/month
- Unlimited assets for your clients
- White-label PDF reports
- API access
- Help fixing findings from fullstackpartner.com
Planned prices. Payments are not switched on yet, so everything is free while we are in beta.
Our scanning rules
Port scans and deep website scans only run against assets you have proved you control, with a DNS TXT record or a file on the server. Every scan identifies itself as FSP-Security-Scanner, comes from one published IP, never tries to log in or exploit anything, and refuses private and internal addresses. Quick SiteSentry scans only read what any browser can see.