In short
WebIntacta's website security scan (Jose Soriano) is free, online and needs no sign-up, and it takes a few minutes: you enter the address and it checks from the outside for versions with published vulnerabilities, exposed files, HTTPS, headers, domain email and blacklists. It gives a grade from 0 to 100 and a task list ordered by urgency. It installs nothing and doesn't try passwords, so it can't see what's hidden on the server; that's what the internal report is for, from €129.
Reviewed by Jose Soriano ·
Enter the address and the scanner checks what anyone can see of your website from the internet. It installs nothing, doesn't try passwords and doesn't touch your server. When it's done you get a grade from 0 to 100 and a task list ordered by urgency.
Data protection. Controller: Jose Soriano Castro. Purpose: to send you the diagnostic PDF, email you for 30 days if a security flaw affecting your site is published (with a follow-up scan on day 30) and reply in writing to your question; offers only if you tick that box. Legal basis: your consent. Recipients: nobody, unless required by law. You can unsubscribe at any time with the link in every email or by writing to me. Rights: access, rectification, erasure, objection, restriction and portability. Privacy policy.
STEP 01
Only websites you own or manage with permission.
STEP 02
Grade, a plain-language summary and an action plan. You can share it with a private link.
STEP 03
Fix it yourself, pass it to your provider or hire me. If you also want to see what's inside, there's the report with the connector.
Checking a website's security online, without installing anything, has a clear limit: you only see what the site shows to any visitor. Within that limit you find a lot, because most automated attacks look for exactly that: a known version, a forgotten file, a missing header.
The scanner identifies the platform and the visible versions and checks them against published vulnerabilities; it looks for paths that shouldn't respond (/.git/, .zip backups, .env); it checks the certificate, the HTTP security headers and the domain email; and it looks up blacklists. Every problem comes with what it means, who should fix it and how urgent it is.
It's a free first-pass audit, not a full audit. It can't see server files, the database or users. That's what the website security audit with the read-only connector is for. If you suspect something is already inside, read how to tell if your website is hacked as well.
It detects WordPress, WooCommerce, PrestaShop, Joomla, Drupal, Magento, Shopify, site builders such as Wix and custom-built sites, and adapts the checks to each one. What's worth checking from the inside on each platform: WordPress security, PrestaShop security, Joomla security, Drupal security, Magento security and Shopify security. Domain email has its own guide: SPF, DKIM and DMARC.
The external scan is always free. The internal report sees what can't be seen from the outside.
Security grade and the problems visible from the internet, in a few minutes and with no sign-up.
Free
No sign-up, no commitment
An inside analysis with the read-only connector and a PDF with an action plan.
€129
excluding VAT$129 outside the EU
Everything in the website report, plus a review of checkout and the store's modules.
€169
excluding VAT$169 outside the EU
Outside the EU the scan is just as free, and the internal report is $129. All prices
Guides
It sees the symptoms that reach the browser: scripts injected into the home page, redirects, visible spam, blacklisted domains and versions with published vulnerabilities. It can't see what's hidden on the server without showing anything to the outside: a backdoor in a PHP file, a new administrator account or code in the database. A clean result makes an infection much less likely, but doesn't rule it out: that's what the internal report is for.
The scan only looks at what the site shows to any visitor, with few requests and without trying to exploit anything. Even so, use it only on websites you own or manage with the owner's permission.
The scanned address and the result are stored, so I can show you the report and you can share it with a link that doesn't appear in search engines. I don't ask for your name or email to run a scan.
It tells you what to do, in order and in plain English, and who should do it. And if you need it, there's a person behind it who can fix it.
Free external scan. No sign-up and nothing to install.
Data protection. Controller: Jose Soriano Castro. Purpose: to send you the diagnostic PDF, email you for 30 days if a security flaw affecting your site is published (with a follow-up scan on day 30) and reply in writing to your question; offers only if you tick that box. Legal basis: your consent. Recipients: nobody, unless required by law. You can unsubscribe at any time with the link in every email or by writing to me. Rights: access, rectification, erasure, objection, restriction and portability. Privacy policy.