01
Enter the domain
Use the public hostname of the store, such as your-store.com.
See what your store shows the public internet.
A passive check of email authentication, DNS, the certificate, response headers, and third-party scripts. The score runs from 0 to 100. The result page shows one problem.
Five scans an hour from this network.
The check reads public records only. It does not log in and it does not change the store.
How a scan runs
02
The scan is queued
It reads public DNS, certificates, and pages. A scan usually finishes within a minute.
03
Open the result
The page shows the score, the counts, and one problem. The URL does not change, so you can share it.
What this check reads
- SPF, DKIM, and DMARC
- DNS records, expiry, and takeover signals
- TLS certificate, HTTPS redirect, and HSTS
- Response headers and cookie flags
- Third-party scripts on the storefront
- Lookalike domains
- Exposed paths and software version tokens
- Public breach data, only when a breach API key is configured on the server
Shopify app plans
The scan on this site does not ask for a card. The prices below are the app plans, in USD, taken from the product config.
Free
$0 a month
Pro
$19.99 a month
Business
$49.99 a month
Questions
What does the scan check?
The public hostname you enter. It reads SPF, DKIM, and DMARC, DNS and takeover signals, the TLS certificate and the HTTPS redirect, response headers and cookie flags, third-party scripts, lookalike domains, and exposed paths or version tokens. Public breach data is included only when a breach API key is configured on the server.
Is this a penetration test?
No. The check does not exploit the store, log in, or run the page’s JavaScript. A high score does not prove the store is safe.
What is on the result page?
The score, the grade, the problem counts, and one problem with a fix. Other problems are not listed on that page. The full list is in the email, after you ask for it. Anyone with the URL can open the page.