Free website security check, in seconds.

The instant check is passive reconnaissance — it collects what your domain already exposes to anyone who looks, without sending a single hostile request. That is exactly the information attackers gather first, so seeing it yourself is the fastest way to understand your real exposure:

• Subdomains — forgotten staging sites, old admin panels and dev boxes are the classic quiet way in.
• Tech stack & versions — what software your site advertises, and whether it flags you as an easy target.
• DNS & email posture — SPF, DKIM and DMARC configuration that decides whether criminals can spoof email from your domain.
• Security headers & TLS — the browser-level protections (CSP, HSTS, cookie flags) most small sites are missing.

No login, no code snippet, no agent to install, and zero impact on your site — the check reads public records and response headers the same way a search engine does. Results appear in seconds.

The free check tells you what’s publicly exposed. It can’t tell you whether your login form has a broken access-control bug, whether your checkout logic can be abused, or whether an old admin panel is quietly reachable — those only surface when a person reasons through how your site is supposed to work. That’s what a manual audit is for.

The Circuit audit is $49 one-time: a full manual audit of your site with a written report of every vulnerability found — severity, evidence, plain-English impact and exact fix steps, suitable to share with enterprise customers who ask for proof of testing. Signal ($299) adds the fixes: we repair the high and critical issues with you and provide 3 months of cover. Both carry a 14-day money-back guarantee before the audit begins. The honest caveat: $49 buys a productized small-site scope, not a multi-week enterprise engagement — for most small businesses that is precisely the right size, and if your scope is bigger we’ll say so before taking your money.

Every free security scanner, ours included, works the same basic way: compare what your domain publicly exposes against known patterns and CVE lists. That’s useful — it catches real, common issues — but it can’t find what actually gets small sites hacked: broken access control, authentication weaknesses, and business-logic bugs in your forms and checkout. Those only surface when a person reasons about how your site is supposed to work. That is exactly why sub-$1,500 “pentests” from big firms are usually rebranded automated scans, while real manual engagements average around $18,000 — and why we built Circuit as an honest middle ground: a real engineer, for $49.

More on where bots stop and humans start in manual vs automated penetration testing.

We take the legal and ethical side seriously, because you should expect that from anyone touching your security:

• Passive only, until you say otherwise. The free check never attacks, probes or logs into anything — it reads what your domain already publishes.
• Ownership verified before active testing. Any hands-on testing requires you to prove you control the domain (email, DNS, file or meta-tag verification).
• Recorded Authorization to Test. Before an audit begins, you explicitly authorize it in writing — so everything is legal, documented and above-board.
• No pressure funnel. The free results are yours either way. No mandatory sales call, no auto-enrollment, and published pricing if you want more.

We serve customers worldwide, and we also publish free security tools you can use yourself, whether or not you ever pay us anything.