60 modern security features
16 features available on the free tier. 18 more unlock on Starter, 15 more on Pro, plus 11 Enterprise-only active testing, AI Pentesting, and authenticated scanning features. Filter below to see exactly what you get at each level.
Scanning
Paste any URL and get a complete security snapshot across all 8 layers in under 15 seconds. No account, no setup.
Scanning
HTTP/TLS, HTML, network traffic, JavaScript CVEs, tag managers, third-party supply chain, platform misconfigurations, server/CMS software CVE checks, and AI synthesis all run on every scan.
Platform Security
Detects the most common security failures in apps built with Lovable, Supabase, Base44, Bubble, and similar AI app builders - publicly readable databases, exposed service_role keys, and known platform CVEs.
Scanning
Retire.js + OSV database checks against every JS library identified on the page. Pinpoints the exact file and version with the CVE ID linked.
Scanning
Web server software disclosed in response headers (Apache, nginx, IIS, PHP, and more) is matched against the National Vulnerability Database, with the exact version and CVE ID shown for anything found.
Scanning
Detects the CMS or e-commerce platform a site runs on - WordPress, Joomla, Drupal, Magento, Shopify, Wix, Squarespace, Webflow, and more - and checks any self-hosted, version-disclosed platform against the National Vulnerability Database.
Scanning
Every external domain your page contacts - categorised by purpose, checked for registration age, and flagged if they match threat intelligence signals.
Scanning
Full checklist of CSP, HSTS, X-Frame-Options, Referrer-Policy, Permissions-Policy, cookie flags, CORS, and server version disclosure.
Scanning
Identifies every GTM container, lists all active tags and their firing triggers, and flags tags sending data to unrecognised or newly-registered domains.
Scanning
Every scan produces a weighted 0-100 score and A-F grade calculated from finding severity across all 8 layers. Comparable across scans over time.
Scanning
Headless browser records every request made on page load - third-party scripts, WebSocket connections, dynamically injected tags, and storage writes.
Active Testing
Enterprise scans go beyond passive observation with safe, non-destructive active probes - forced browsing, reflected-input canaries, CORS and HTTP-method checks, postMessage handler auditing, and more.
Active Testing
Active-testing checks are scored separately from your overall report - a dedicated grade for what was actively probed, alongside your regular security score.
Active Testing
Capture a logged-in session via our browser extension and the agent crawls behind your login - the only mechanism that works for passkey/WebAuthn auth, since there is no credential to script or store.
Active Testing
A standalone, boardroom-ready PDF scoped to Active Testing results only - severity donut, a full "what we tested" checklist, and remediation excerpts.
API Security
Finds REST, GraphQL, and SOAP APIs via OpenAPI/Swagger specs, GraphQL introspection, WSDL definitions, and a common-path scan of both a wordlist and your site's own JavaScript - then runs safe, non-destructive tests on each: does it require auth when it should, is GraphQL introspection left open in production, does it leak data via misconfigured CORS.
AI Pentesting
Sandboxed runs of sqlmap (SQL injection, including login forms), dalfox (XSS), ffuf (hidden parameter discovery), nuclei (exposure & misconfiguration deepening), and jwt_tool (JWT weak-secret cracking) against targets your scan already flagged - a fixed toolkit, not an AI improvising attacks.
AI Pentesting
Every confirmed finding carries the exact request and response that proved it, not just a plausible-looking signal - and results that were blocked or inconclusive (a WAF, a TLS handshake failure) are labelled as such rather than shown as a false clean or false positive.
AI Pentesting
Each run happens in an ephemeral, isolated sandbox with network egress scoped to only the domain being tested. Requires its own explicit consent checkbox on top of Active Testing's - real exploitation attempts, not passive observation.
AI Pentesting
Computed only from confirmed pentest findings and shown alongside - never blended into - your overall security score and your Active Testing Score, so you can see exactly what real exploitation attempts found.
AI Pentesting
A dedicated, auditor-ready PDF scoped to pentest results only - proof-of-exploit evidence included - separate from both your main report and your DAST report.
AI Pentesting
The Pentest Report PDF is bundled into the same audit evidence ZIP export as your main and DAST reports, ready to hand to an auditor without hunting down a third download.
DNS & Subdomains
SPF, DMARC, DNSSEC, CAA, mail and nameserver records - every check shown, even when clean, so you can see exactly what was verified.
DNS & Subdomains
Certificate issuer, expiry, protocol version, cipher suite, and key strength - flagging weak or expiring certificates before they become an outage or a warning page.
DNS & Subdomains
Finds forgotten staging, dev, and admin subdomains via common-name enumeration plus a certificate transparency log lookup (real hostnames a public CA has issued a certificate for), with a quick reachability check on each - and a one-click button to run a full scan on any of them.
DNS & Subdomains
Every discovered subdomain's CNAME record is checked against commonly-hijacked services (GitHub Pages, Heroku, S3, Azure, Netlify, and others) for dangling or unclaimed targets an attacker could register and serve content from.
Scanning
Scan a bare domain or IP directly - no scheme required. Automatically tries HTTPS, HTTP, and common alternate ports, and always reports what it found.
Scanning
When you scan a bare IP directly, a passive connect-only probe checks common non-web service ports (databases, remote access, file transfer) for exposure, captures any banner offered, and runs a reverse DNS (PTR) lookup - never sends payloads or attempts exploitation.
AI Investigation
An AI agent crawls your entire site - or a defined scope - running all 8 layers on every page it decides is worth investigating.
AI Investigation
Watch the agent explain every decision in real time as it investigates. Each step is logged with the finding that triggered it - useful as an audit trail.
AI Investigation
When an exposed .map file is found, the agent fetches it and reconstructs original source to check for hardcoded secrets and internal architecture leaks.
AI Investigation
Goes beyond identifying the container ID - fetches and parses the full tag configuration, including nested tags, custom HTML tags, and variable definitions.
AI Investigation
Every third-party domain your site contacts is checked against a live malware/phishing database and flagged for suspicious registration patterns (unusual TLDs, numeric-heavy names).
AI Investigation
AI-written remediation steps specific to each finding - not generic advice. Tells your developer exactly what to change and why.
AI Investigation
A ranked top-25 fix list from your latest scan, deduplicated and written in plain English, exportable as a PDF you can hand straight to a client or developer without them opening the full report.
Reports
Plain-English summary of your security posture written by an LLM that has read all findings holistically. Readable by a CTO, auditor, or board member.
Reports
Every free report gets a public URL you can send to a developer, client, or auditor. Sign up to save reports to your account permanently.
Reports
Timestamped, formatted PDF with your scan details, findings, and an attestation block. Accepted by auditors for SOC2, ISO 27001, NIS2, and DORA evidence.
Reports
Every scan you run is preserved indefinitely. Filter by domain, date, or severity to find any past report instantly.
Reports
Side-by-side diff between any two scans of the same site. See exactly what findings are new, what has been resolved, and what has changed severity.
Reports
Export a date-range ZIP of all scan history - formatted for auditor handoff. Includes all PDFs, finding logs, and scan attestation metadata.
Reports
Put your own logo, name, accent colour, and font on every PDF report, DAST report, and evidence package you export - no Decloak branding, ready to hand straight to your clients.
Compliance
Every finding is automatically tagged to the relevant ISO 27001 Annex A controls. Filter your report to show only findings relevant to a specific control.
Compliance
Findings tagged to SOC2 Trust Services Criteria (Security, Availability, Confidentiality). Makes it straightforward to respond to auditor questions by control.
Compliance
Findings tagged to NIS2 Article 21 risk-management measures - built for the EU directive’s October 2026 compliance deadline, now covering roughly 160,000 in-scope entities.
Compliance
Findings tagged to DORA ICT risk-management and third-party risk articles - for financial-sector and critical-infrastructure entities under the EU’s Digital Operational Resilience Act.
Compliance
Mark each finding as Open, In Progress, Resolved, or Accepted Risk and assign it to a teammate - upgrades the Priority Remediation Plan and All Findings from view-only to fully editable. Auditors need to see that findings are being acted on - this closes that loop.
Compliance
Every scan is stamped with who triggered it, when, from where, and with which configuration. Full chain of custody for compliance evidence.
Compliance
A per-domain log of every scan, deletion, and finding change - who did it and when. Recorded from day one, so it’s already there the moment you upgrade to Pro.
Automation
Set a weekly, monthly, or quarterly cadence and scans run automatically. Never miss a security check-in for SOC2, ISO 27001, NIS2, or DORA again.
Automation
Get notified when a scheduled scan completes or when a new critical or high severity finding is detected - before your next scheduled check.
Automation
New critical findings delivered to a Slack channel of your choice within minutes. Useful for security channels and on-call workflows.
Automation
Push findings to any system - Jira, Linear, PagerDuty, or your own. Signed payloads (HMAC), per-endpoint event selection, and a delivery log.
Automation
Trigger scans programmatically and pull results via a REST API - poll status, fetch findings, list scans for a domain. Full OpenAPI docs included.
Automation
Let Claude, Cursor, or any MCP-compatible AI agent trigger scans and poll results directly - create_scan, get_scan, list_scans, and wait_for_scan tools, no glue code required.
Support
A chat assistant that knows your scan results - ask it to explain a finding, walk through remediation, or find the right guide, right from the report or dashboard you're already on.
Team
A glanceable, colour-coded report card for your whole account and every domain - security score, findings by severity, DNS/TLS posture, active testing, and compliance coverage all in one grid. Free for every account; paid tiers unlock more tiles as you upgrade.
Team
Your account shows all scans organised by domain - current grade, last scanned, open findings. Free for all accounts. Pro adds team sharing and bulk actions.
Team
Invite team members with role-based permissions. Developers see findings and remediation; managers see scores and reports; admins manage everything.
Team
Tag any finding to a specific team member, with bulk-assign by category or by scan. A dedicated "My Assigned Findings" page tracks status and remediation notes.
60 of 60 features shown
No account needed. Paste a URL on the homepage and get your report in 15 seconds.
Scan free nowAI agent investigation, DNS/SSL analysis, scheduled scans, PDF evidence export, and everything above.
Everything in Starter, plus ISO 27001/SOC2/NIS2/DORA mapping, team access, audit evidence packages, and API access.
Active Security Testing (DAST), AI Pentesting exploitation-confirmation testing, and authenticated scan mode via session capture, on top of everything in Pro.