From $0 · nothing to install
“Is your website safe?”
Now you have an answer.
Customers ask. Partners ask. Sometimes it is on a form before they will buy from you. We check your site from the outside, tell you plainly what to fix, and give you a badge they can click and check for themselves.
No card needed. Nothing to install. We never need your passwords, your code or access to your server.
What your visitors see
Clicking it opens a page showing the date, what was checked and what was found. Not a logo you can copy — a result anyone can look up.
How do you prove it without opening everything up?
The usual answer is to let an auditor into your systems — your code, your logins, your server. That is slow, expensive, and for most sites it is far more than anyone was asking for.
We look at your site the same way a stranger on the internet does. Nothing is installed, nothing is logged into, nothing is changed. If something is visible to us, it is visible to them — and that is the part worth knowing about.
What we never need
- Your passwords
- Your source code
- Access to your server
- Anything installed on your site
The badge, and the page behind it.
A badge on its own is just a picture. This one links to a page that says when the site was checked, what was looked at, and what was found — so the person asking can satisfy themselves without taking your word for it.
Passed the full check.
Passed the free check. Says so, plainly.
Something serious is open. No badge until it is fixed.
We will not issue a badge for a site with a serious problem open, however much anyone would like one. That is the only reason the badge is worth anything.
If you build with an AI assistant
Let it do this for you.
If you use Claude, Cursor, ChatGPT or anything like them, point it at our connector and it handles the whole thing — adding your site, running the check, reading what came back, fixing it, and fetching your badge.
You approve it once, in your browser, and you can see exactly what you are agreeing to before you do. It cannot spend money unless you let it, and you can switch it off whenever you like.
https://scan.hefes.net/mcp
What it does on its own
- Adds your site and proves it is yours
- Runs the check
- Explains and fixes what it finds
- Checks again, and collects the badge
What it costs.
Free
$0
The common problems, on your main address. Enough to earn a badge if nothing is wrong. Once every 90 days.
Full check
$49
Everything, across your site and the addresses underneath it. The report, and the full badge.
Check it again
$9
After you ship something, while your badge is still current. Cheap on purpose — we would rather you checked.
If a check finds something serious, fixing it and proving it is free: you get one more check at no cost. Nothing is charged until you ask for a full one, and there is no subscription.
The honest part.
What this is
- An automated check, run from one published address, on a date
- Everything visible from outside: open doors, expired certificates, files that should not be public, keys left in your pages, out-of-date software
- A plain list of what to fix, in the order worth fixing it
What it is not
- Not a guarantee. It means these checks found nothing that day
- Not a person testing your site by hand, and not a substitute for one
- We never break in, guess passwords, or change anything on your site
You prove the site is yours before anything is checked — every time, not just the first. Read the rules we scan by, the terms, the privacy policy, or what our scanner is if you found it in your logs.
See what a stranger sees.
It is free, it takes a few minutes, and you do not need a card.