Hefes Scan

Two scans.
No subscription.

Black-box security testing at a price that doesn't need a budget meeting. Start free, pay once when you want the whole picture. Every plan asks you to verify who you are and prove you control the domain — here's why.

Free scan

$0

Security headers, checks for files that should not be public, and a score for how well search engines and AI assistants can read your site. Everything it finds is reported in full.

1 domain

Run the free scan
  • Security headersWhether your site tells browsers to protect your visitors — HTTPS enforcement, clickjacking and content-type protections.
  • Exposed filesChecks for files that should never be public: source control directories, .env files, database files, backups, configuration and browsable folders.
  • Search engine and AI readinessA score for how well Google and AI assistants can actually read your site.

Everything the free scan finds is reported in full, including anything serious. The paid scan runs more checks, not fewer results. It looks at your main domain only.

Standard scan

$49

The same checks as the free scan, run whenever you want it. For confirming a fix, or checking again before a launch, without waiting for your free scan to come round.

1 domain

Get the standard scan
  • Security headersWhether your site tells browsers to protect your visitors — HTTPS enforcement, clickjacking and content-type protections.
  • Exposed filesChecks for files that should never be public: source control directories, .env files, database files, backups, configuration and browsable folders.
  • Search engine and AI readinessA score for how well Google and AI assistants can actually read your site.

The same checks as the free scan, with no waiting between runs. Your main domain only — the full scan is the one that covers subdomains.

One-off full scan

Includes the seal

$199

The complete scan, once: ports and services, a crawl of the site, review of any API found, credentials left in your JavaScript, and known-vulnerability checks for WordPress and its plugins. Includes the PDF report and the verification seal.

1 domain · subdomains included

Get the full scan
  • Ports and servicesWhat is listening on your server and what it is, including databases that should never be reachable from the internet.
  • Security headersWhether your site tells browsers to protect your visitors.
  • Site crawlWe read your pages the way a visitor would, to find what is reachable.
  • Exposed files and source codeSource control, .env files, databases, backups, compiled code, server-side code served as text, and browsable folders.
  • Platform and pluginsIdentifies WordPress, WooCommerce, Shopify and the rest, then checks your plugin versions against published vulnerabilities — including ones that allow database access.
  • Search engine and AI readinessA score for how well Google and AI assistants can read your site.
  • Secrets in your JavaScriptCredentials accidentally shipped to every visitor — payment keys, database keys, and the build-time variables frameworks quietly bundle in.
  • Firebase and Supabase rulesWhether the database behind your app is readable by anyone who visits it.
  • What your pages give awayCard numbers, server file paths, internal addresses, developer comments left in the HTML, public storage buckets, and third-party scripts loaded without a content check.
  • Out-of-date librariesIdentifies the framework you built on and checks the library versions your site reports against published security advisories — the most common way a site built with an AI assistant is broken into.
  • API reviewAny API we find is checked for missing authentication, leaked error detail and cross-origin rules that let other sites read your data.
  • TLS and certificatesYour encryption configuration and certificate validity.
  • Known vulnerability signaturesThousands of checks for publicly documented issues.

You walk away with

  • A PDF report you can keep, send or show an insurer
  • The same report as a text file, built to paste into an AI assistant
  • A verification seal for your site, once you pass
  • A permanent record on chain proving the report was not altered

Payments by Stripe. Card details go straight to them and never reach our servers. Prices in US dollars.