Check your website's security. Free, in minutes.
Enter your website's or app's address. We check what anyone on the internet can see: the secure connection, security settings, files and pages that shouldn't be public, and for web apps, leaked keys and open databases. Each finding says what to fix, with its OWASP reference.
Free. Results in about 5 minutes. We only read what any visitor can see.
What the free security check looks at
Everything here is checked from the outside, the way any visitor or attacker sees your site.
The secure connection
Whether http:// sends people to https://, when your certificate expires, HSTS, and insecure files loaded on secure pages.
Security settings
Security headers such as the Content Security Policy and frame protection, and servers that announce their software version.
Error pages and forms
Error pages that show your code or server details, and forms that would send personal details in the web address.
For web apps: keys and data
OpenAI, Stripe, Razorpay and database keys in the code visitors download, and Supabase or Firebase data anyone can read.
For web apps: files and libraries
Private files like .env and .git, published source code, open API documentation, libraries with known security holes, and a security.txt contact.
A VAPT checklist, and what we cover
A VAPT (vulnerability assessment and penetration test) follows the OWASP testing areas below. Here's which of our checks covers each one.
Security settings and misconfiguration
Free check, from the outside.
Sensitive data exposure
Free check from the outside; the ₹299 check also reads what your server sends to signed-in users.
Outdated and vulnerable components
Free check, for web apps.
Access control: who can see what
₹299 check as one test user; the ₹999 audit-ready check repeats every request as two or three users.
Injection and cross-site scripting
₹999 audit-ready check: safe test inputs, on your test copy, with your written permission.
Sign-in, sessions and tokens
₹999 audit-ready check.
Servers, network, logging and load
Not covered: these need access to your servers or could disrupt your app. A formal VAPT covers them.
When you still need a formal VAPT
Our checks get you ready for one; they don't replace it.
A client or regulator asks for it
Banks, enterprises and government buyers often ask for a VAPT report from a CERT-In empanelled firm. That's the report to give them.
Before it, fix what's easy to find
A formal VAPT costs ₹40,000 to ₹1.5 lakh or more per app. Fixing what our checks find first means the auditor's time goes on what's left.
After it, check again
The ₹999 audit-ready check includes a free re-check after you fix things.
Three ways to check your app
Start free, from the outside, the way any visitor sees your app. Then let us in as a test user to check the app itself, or as two or three users for the audit-ready check.
Security from the outside
- Secret keys in your app's code, and databases anyone can read
- Private files left online (.env, .git), published source code
- Security headers, sign-in cookies and the certificate
- API docs, diagnostics and folders open to anyone
- Libraries with known vulnerabilities, error pages that leak details
- Load speed, and your public pages if you have any
The product itself
- Access control: can a normal user reach admin screens or other customers' data?
- What your server sends the browser: password data, codes, secret keys
- Personal data in addresses or sent to third parties; cookies, CORS, GraphQL
- Errors, failed requests and broken screens
- Numbers and calculations checked across every screen
- Usability and layout on a computer and a phone
Offered on your report once the free check sees an app. Money back if we can't sign in.
Audit-ready check
- Everything in the ₹299 check
- Two or three test users: every request repeated as each one, to see who can read what
- Safe security tests on your test copy, such as injection and cross-site scripting
- Sign-in, sessions and tokens
- Accessibility (WCAG 2.2) and India's data protection law (DPDP)
- OWASP, WSTG and ASVS references on every finding, and a free re-check after you fix things
Runs on a test copy of your app, with your written permission. Full refund if we can't complete your report.
FAQ
Is the website security check free?
Yes. Enter any address and you get a grade and the security findings, with what to fix. We ask only for your email to unlock the full technical list.
Will the check harm my website?
No. The free check only reads what any visitor can see: pages, headers and well-known addresses. The ₹999 audit-ready check runs safe tests, but only on a test copy of your app and with your written permission.
What is a VAPT?
A vulnerability assessment and penetration test: specialists look for security weaknesses in your app and try to use them, the way an attacker would, and write a formal report.
How much does a VAPT cost in India?
Usually ₹40,000 to ₹1.5 lakh or more per web app, depending on its size and how many user roles it has. Our ₹999 audit-ready check helps you fix the common problems first, so the formal audit finds less.
Is this a VAPT?
No. It's the step before one: the checks an auditor starts with, run in minutes. A clean result means you're ready for a formal audit, not that your website is secure.
What is the OWASP Top 10?
The list of the most critical web application security risks, published by OWASP, which most security audits follow. Each security finding in our report shows its OWASP category.
Check your website's security in a few minutes.
Free from the outside. ₹299 and ₹999 checks for web apps, before your VAPT.