AI QA Monkey ✓

Right now, automated bots are probing your website for a single mistake: an exposed .env file, an open database port, an API key left in your JavaScript, a vulnerable plugin, a subdomain an attacker can hijack. Most owners discover the hole after the breach — when Google blacklists the domain, customers vanish, and the incident bill lands. AI QA Monkey finds it first.

Paste any URL and receive a complete forensic security audit in about 60 seconds — free, no signup, no credit card. A professional penetration test costs $1,500–$5,000 and takes weeks. We compress that into one minute and 100+ automated checks across your entire external attack surface.

━━ WHAT WE INSPECT ━━

TRANSPORT & ENCRYPTION. Full SSL/TLS validation — certificate chain, issuer, expiry countdown, signature algorithm, negotiated protocol version, and weak-protocol / expiring-cert alerts. HSTS strength analysis (max-age, includeSubDomains), HTTPS-redirect enforcement, and mixed-content detection.

SECURITY HEADERS. A graded A–F audit of ten headers — Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, and the full Cross-Origin trio (COOP, COEP, CORP). We parse your CSP for real weaknesses — unsafe-inline, unsafe-eval, wildcard sources, report-only-not-enforced — and flag clickjacking exposure and server-version leakage.

REAL-TIME PORT SCANNING — ON OUR OWN INFRASTRUCTURE. This is the engine we built ourselves. We don't resell a stale, weekly-refreshed threat database like most scanners. We operate dedicated nmap-backed scanning infrastructure that probes 19 high-risk ports live on every free scan — SSH, RDP, MySQL, PostgreSQL, MongoDB, Redis, Elasticsearch, SMB, cPanel, mail services and more — and recognizes 40+ services. Premium unlocks a full sweep of all 65,535 ports. When an exposed service maps to a known CVE, we surface it. Shared-hosting and CDN-edge aware, so you see your true origin exposure, not false positives.

EXPOSED FILES & LEAKED SECRETS. Parallel probing of sensitive paths — .env and its variants, .git/HEAD and config, .svn, wp-config backups, SQL dumps, .htpasswd, phpinfo, adminer, debug logs, server-status. Plus live client-side secret detection: private keys, AWS access keys, Stripe live keys, SendGrid, GitHub and Slack tokens, and Google API keys sitting in your HTML and JS bundles. Plus exposed JavaScript source maps that hand attackers your original source.

SUPPLY-CHAIN & MAGECART DEFENSE. The #1 way modern sites get breached. We flag compromised or abandoned third-party CDNs (polyfill.io-class attacks), missing Subresource Integrity on cross-origin scripts, and card-skimmer injection risk — and we fingerprint your front-end libraries (jQuery, Bootstrap, Lodash, Handlebars, Axios, Moment.js) against a curated CVE table, naming the exact patched version.

DNS, EMAIL TRUST & REPUTATION. A complete email-spoofing defense audit — SPF with policy strictness, DKIM across nine common selectors, DMARC enforcement level, plus MTA-STS, TLS-RPT, BIMI and CAA. Real-time domain reputation and blacklist checks, and DNS record analysis.

ATTACK SURFACE & RECON. Subdomain enumeration via certificate-transparency logs with dangling-CNAME takeover detection across 14 cloud providers. CORS misconfiguration and origin-reflection (including the critical wildcard-with-credentials case), dangerous HTTP methods (PUT, DELETE, TRACE), GraphQL introspection, and Swagger/OpenAPI endpoint discovery. Technology fingerprinting (CMS, server, framework versions), WAF detection (Cloudflare, AWS WAF, Sucuri, Akamai, Incapsula), CDN identification, and cloud-storage reference detection (S3, Azure Blob, GCS).

WORDPRESS & CMS. User enumeration, xmlrpc.php exposure, plugin detection, version disclosure via readme, and wp-config backup exposure — the WordPress attacks basic scanners skip.

COOKIES & SESSIONS. Secure, HttpOnly and SameSite flag analysis on session cookies.

━━ BUILT FOR YOUR STACK ━━

Beyond the universal scan, dedicated deep scanners tune every check to your framework — WordPress, Shopify, React, Next.js, Angular, Laravel, Drupal and Joomla, plus focused API/CORS, open-port, DNS/SPF/DMARC and compliance scanners. Next.js apps get SSRF and NEXT_PUBLIC_ leak checks; Laravel gets APP_DEBUG and exposed Telescope/Horizon detection; Drupal gets Drupalgeddon coverage — the vulnerabilities that only matter on your platform.

━━ HOW IT SCORES ━━

Every finding is ranked Critical / High / Medium / Low / Info and rolled into a weighted 0–100 security score across six categories — Application, Infrastructure, Transport, Email, Compliance and Reputation — with an estimated score-after-fix so you know the payoff before you touch a line. A dedicated compliance engine maps your posture to OWASP Top 10 (2021), PCI DSS v4.0, ISO 27001 Annex A, SOC 2 Type II and GDPR technical controls, with a per-framework readiness score.

━━ HOW YOU FIX IT ━━

Finding problems is easy. We're obsessed with closing them. Every single vulnerability ships with four things: a tested copy-paste server config (Apache / Nginx / WordPress), an AI Fix Prompt engineered for ChatGPT, Claude and Cursor, a difficulty rating and estimated fix time ("Easy, ~20 min"), and a step-by-step plain-English playbook — backed by a library of 45+ in-depth remediation guides. You don't need a security team. You need 20 minutes and a clipboard.

━━ HOW YOU STAY SECURE ━━

Hackers don't scan you once, so neither do we. 24/7 continuous monitoring re-scans your site automatically and emails you the moment your score drops or a new vulnerability appears — before attackers find it. Every one-time report includes 30 days of monitoring, free.

━━ HOW YOU PROVE IT ━━

Score 80+ and claim your free Verified Security Badge — a live, database-verified trust seal that embeds with one line of HTML, updates on every scan, and lets visitors click through to watch your site pass a live audit. Turn security into a sales asset.

━━ THE REPORT ━━

A twelve-section dashboard and boardroom-ready PDF: security score gauge, severity distribution, full vulnerability table with evidence, kill-chain analysis, interactive Attack Surface Map (rendered as a live network graph in both the dashboard and the PDF), compliance mapping, copy-paste fixes, AI fix prompts, executive summary, trend view, evidence mode, and one-click export to white-label PDF, JSON and CSV. Everything lives in the My Reports portal — passwordless access from any device with a one-time email code.

━━ PRICING ━━

Free scan, forever. Full report — $29 one-time per domain, yours to keep. Pro — $29/mo with up to 30 reports per domain and the Verified badge. Agency — $79/mo for a 10-domain portfolio. Risk-free: full refund if your security rating doesn't improve within 30 days.

Your site is either verified secure — or it's an open question. Find out in 60 seconds.