Free website security check, reviewed by a human.

The instant check is passive reconnaissance — it collects what your domain already exposes to anyone who looks, without sending a single hostile request. That is exactly the information attackers gather first, so seeing it yourself is the fastest way to understand your real exposure:

• Subdomains — forgotten staging sites, old admin panels and dev boxes are the classic quiet way in.
• Tech stack & versions — what software your site advertises, and whether it flags you as an easy target.
• DNS & email posture — SPF, DKIM and DMARC configuration that decides whether criminals can spoof email from your domain.
• Security headers & TLS — the browser-level protections (CSP, HSTS, cookie flags) most small sites are missing.

No login, no code snippet, no agent to install, and zero impact on your site — the check reads public records and response headers the same way a search engine does. Results appear in seconds.

Here is the part no scanner offers: after the passive check, a Bug Circuit engineer reviews your site and gives you a yes/no answer on critical bugs — free. Not a 40-page PDF of maybes. One clear answer from a person who tests websites for a living: “we see something critical” or “nothing critical visible from the outside.”

If you want the complete picture, the Circuit audit is $49 one-time: a full manual audit of your site with a written report of every vulnerability found — severity, evidence, plain-English impact and exact fix steps, suitable to share with enterprise customers who ask for proof of testing. Signal ($299) adds the fixes: we repair the high and critical issues with you and provide 3 months of cover. Both carry a 14-day money-back guarantee before the audit begins. The honest caveat: $49 buys a productized small-site scope, not a multi-week enterprise engagement — for most small businesses that is precisely the right size, and if your scope is bigger we’ll say so before taking your money.

Free scanners are automated version-matchers. They compare your software versions against CVE lists and grade your headers. Useful — we do that part too — but they cannot find the flaws that actually get small websites hacked: broken access control, authentication weaknesses, and business-logic bugs in your forms and checkout. Those only surface when a person reasons about how your site is supposed to work. Scanners also produce false positives that a human has to verify anyway — which is why sub-$1,500 “pentests” from big firms are usually rebranded automated scans, while real manual engagements average around $18,000.

More on where bots stop and humans start in manual vs automated penetration testing.

We take the legal and ethical side seriously, because you should expect that from anyone touching your security:

• Passive only, until you say otherwise. The free check never attacks, probes or logs into anything — it reads what your domain already publishes.
• Ownership verified before active testing. Any hands-on testing requires you to prove you control the domain (email, DNS, file or meta-tag verification).
• Recorded Authorization to Test. Before an audit begins, you explicitly authorize it in writing — so everything is legal, documented and above-board.
• No pressure funnel. The free results are yours either way. No mandatory sales call, no auto-enrollment, and published pricing if you want more.

We serve customers worldwide, and we also publish free security tools you can use yourself, whether or not you ever pay us anything.