Guide · about ten minutes
Scan it. Fix it.
Then prove it.
Everything this tool does is in service of one outcome: a site you can point at and say somebody checked this, and here is how you can tell. This page is how you get there, and what the badge is worth once you do.
Start here. It costs nothing.
- 1
Prove the domain is yours.
A DNS TXT record, a meta tag, or a file on the site — whichever is easiest where you host. This is the one step we will never skip or waive, because it is what stops anyone pointing a scanner at a site they do not own.
- 2
Run the free scan.
No card. It checks your security headers, looks for files that should never be public, and scores how readable your site is to search engines and AI assistants. Everything it finds, you see in full — nothing is held back to sell you the upgrade.
- 3
Fix, then re-run.
If it did not pass, the re-run is free and there is no clock on it. Fix what it found, check it worked, and collect the badge.
Which scan, and when.
Three options, and most people should start at the top and only move down when they have a reason to.
$0 · no card
Free scan
Security headers, checks for files that should not be public, and a score for how well search engines and AI assistants can read your site. Everything it finds is reported in full.
Once every 90 days per domain, plus a free re-run if it does not pass. Start here — it is the whole product in miniature, and it is how you find out whether we are any good.
$49
Standard scan
The same checks as the free scan, run whenever you want it. For confirming a fix, or checking again before a launch, without waiting for your free scan to come round.
The same checks as the free scan with no waiting between runs. For when you are mid-fix and want to check again today rather than next quarter.
$199
One-off full scan
The complete scan, once: ports and services, a crawl of the site, review of any API found, credentials left in your JavaScript, and known-vulnerability checks for WordPress and its plugins. Includes the PDF report and the verification seal.
Everything above plus ports and services, a crawl, your APIs, secrets in your JavaScript, your database rules, your libraries and the subdomains beneath your domain. This is the one that produces the PDF and the badge, and the one to run before a launch, an audit or a customer asking hard questions.
A failed run is always free. If a scan breaks on our side, or we cannot reach your site at all, you are not charged and nothing is issued — we would rather tell you we saw nothing than hand you a clean result we did not earn.
Reading it
Fix the top of the list. Ignore the bottom for now.
Findings are ranked, and the ranking is the advice. You do not need to clear the whole report — you need to clear the part that is actually dangerous.
Critical & High
Someone can reach something they should not: an exposed .env, a
database that answers strangers, a key shipped in your JavaScript. These
block the badge, and that is deliberate — a badge on a site with an open
database would be us lending credibility to something genuinely dangerous.
Fix these first. They are usually one configuration change, not a rewrite.
Medium & Low
Hardening, not holes. A missing header, a weaker TLS option, a version you could be further ahead on. Worth doing, and worth doing calmly.
These do not block the badge. A bar nobody can clear is the same as no bar at all.
If you built it with AI, fix it with AI
Hand the whole job to the thing that wrote the code.
Most of our customers shipped fast with an assistant's help. The report is built for that: every finding says what was found, why it matters and what to change, in language a model can act on directly. And the assistant can now do the running-around itself.
- Copy report for your AI on any finished scan gives you the whole thing as Markdown, ready to paste into a chat
- Or connect your assistant. Point it at
https://scan.hefes.net/mcpwith no configuration at all. It will ask you to approve the connection, and from then on it can add your sites, create the DNS record, run scans, read the findings, fix them, and fetch the badge when you pass - You approve once, and you decide what it gets. The page shows exactly what your assistant is asking for before you agree, you set its daily spending limit — or leave it at nothing and keep it to free scans — and you can revoke it from your account whenever you like
- What it never gets. It cannot sign you up, enter a card, delete anything or read your password. Those stay with you, and the first two need a browser whatever we might prefer
Why an approval step at all, when the point is to save you work: an assistant that could aim a scanner or spend money without anyone agreeing to it is a lever worth asking about once. Once is all it is — after that it works unattended.
The badge
Anyone can claim they're secure.
Almost nobody can prove it.
Pass a scan with no critical or high findings and you earn a seal for your site. It is good for 90 days, and re-scanning renews it.
What it says
Checked, on a date, by a named party — and here is the proof.
Every badge links to a public verification page that states exactly what was tested, exactly what was not, when it ran, and the SHA-256 of the report behind it. That hash is written to an immutable public record, so neither you nor we can quietly revise history.
That last part is the bit worth caring about. A badge whose issuer could edit it afterwards is a picture. This one is a receipt.
What it does not say
That your site is unbreakable.
It says no issues were found by the listed automated checks on the stated date. It is not a guarantee, not a penetration test, and not a compliance certification — and the verification page says so in those words, where your customers can read it.
We would rather under-claim and be believed. A badge that overpromises is worth nothing the first time someone checks.
Where to put it, and what it earns you
- Checkout and sign-up pages. The two places a visitor is deciding whether to hand over a card or a password — and the two places hesitation costs you money
- Your footer. Quiet, permanent, and there when someone goes looking for a reason to trust you
- Sales decks and proposals. "Externally scanned, verifiable at this link" ends a conversation that otherwise runs for a week
- Security questionnaires. The PDF answers most of what a procurement form asks, with evidence attached
- Insurers and partners. A dated, third-party, tamper-evident report is the kind of thing that shortens a renewal conversation
- Client work. If you build sites for other people, a passing scan at handover is proof you shipped something sound
Grab the embed code from your domain's page — light and dark, two sizes, one line of HTML. It loads from us, so it always reflects the current state: if your seal lapses, the badge stops claiming it.
Keeping it true.
Re-scan every 90 days
A seal is a statement about a date, so it expires. Your free scan comes round on the same schedule, deliberately — so keeping a badge alive need not cost you anything.
Re-scan after you ship
New dependency, new endpoint, new subdomain. Most of what we find arrived with a change nobody thought was risky.
Keep the proof in place
We re-check that you still control the domain immediately before every scan. Remove the record and future scans stop — which is also how you withdraw permission, any time.
Start with the free one.
It takes a few minutes, needs no card, and tells you in plain language what a stranger can already see.