Website Exposure Check
What can an attacker see about your site from the outside, right now? A read-only check with a written report and a short call to go through it. No access to your server needed.
Who this is for
- Owners who have not been hacked and want to know where they stand before it happens.
- Businesses evaluating a site they are about to take over, buy or migrate.
- Agencies that want an independent check before handing a site to a client.
Website Exposure Check
One domain, external and read-only. Report plus a 20-minute call included.
What's included
- Publicly exposed files and directories: backups, database dumps, configuration copies, logs, installers, version control folders, development leftovers.
- Software and version exposure: CMS, plugins, themes and libraries visible from the outside, matched against known vulnerabilities.
- Admin and authentication surface: login pages, XML-RPC, REST endpoints, user enumeration, default accounts.
- Transport and headers: TLS configuration, redirects, security headers, cookie flags, mixed content.
- Reputation: Google Safe Browsing, common blocklists, spam listings for the domain and mail.
- Signs of existing compromise visible from outside: injected scripts, spam pages in search results, suspicious redirects for crawlers or mobile visitors.
- Written report with findings ranked by severity, and a 20-minute call to go through them.
What's not included
- Anything that requires access to your server or hosting account. This check is external and read-only by design.
- Exploitation or penetration testing. We observe and report, we do not attack.
- Cleanup or fixes. Findings that need work are quoted separately, or covered by Hardening.
How we work
The check uses only what is publicly reachable. We never send exploit payloads to your site.
Request
You give us the domain and confirm you own or are authorised to check it.
External checkwithin 2 business days
Manual review supported by tooling: exposed paths, versions, headers, reputation, visible signs of compromise.
Report
Findings ranked by severity, each with what we saw, why it matters and what would fix it.
Call20 minutes
We go through the report together and answer questions. If you want the fixes done, we quote them.
What you receive
- Written report (PDF) with findings ranked critical / high / medium / low / informational.
- For each finding: evidence, impact, recommended fix.
- 20-minute call to walk through the report.
What changes the price
- Several domains or subdomains of the same business: quoted per domain at a reduced rate.
- If you want the fixes done: Security Hardening & Verification (€300) or a Maintenance plan.
Frequently asked questions
Is this a penetration test?
No. A penetration test actively tries to break in and is a larger, authorised engagement. The Exposure Check observes what is publicly visible and reports it. It is the right first step for most small and medium sites.
Do you need my login or hosting access?
No. Everything is done from the outside, the way an attacker or a scanner would see it. That also means it cannot find what is hidden behind authentication; for that, take Hardening, which includes a review from the inside.
Can I run this on a site I do not own?
Only with the owner's written authorisation. We ask for it in the request.
How is this different from free online scanners?
Free scanners report whatever their rules match, with no judgement. Here a person looks at the results, removes the noise, checks the things scanners miss (exposed backups, dev leftovers, spam cloaking) and explains what actually matters for your site.
Will you tell me if the site is already hacked?
Yes, if it is visible from the outside: injected scripts, spam pages indexed by Google, cloaked redirects. If we see signs of compromise, we tell you immediately and recommend the right next service.
Related reading
From our research notes
Want to know where you stand?
Send the domain. We reply with a confirmation and deliver the report within two business days.