Questions
+What does the scan check?
The public hostname you enter. It reads SPF, DKIM, and DMARC, DNS and takeover signals, the TLS certificate and the HTTPS redirect, response headers and cookie flags, third-party scripts, lookalike domains, and exposed paths or version tokens. Public breach data is included only when a breach API key is configured on the server.
+Is this a penetration test?
No. The check does not exploit the store, log in, or run the page’s JavaScript. A high score does not prove the store is safe.
+What is on the result page?
The score, the grade, the problem counts, and one problem with a fix. Other problems are not listed on that page. The full list is in the email, after you ask for it. Anyone with the URL can open the page.
+How often can I scan?
Five scans an hour from the same network address.
+What do the plans cost?
Free is $0. Pro is $19.99 a month or $199 a year. Business is $49.99 a month or $499 a year. Pro and Business include a 7-day trial in the current config. The install button opens a Shopify App Store listing only when that listing URL is configured.
+Do you keep my email?
Only if you submit it. The address is stored with the domain and the report link so the report can be sent. A contact message is stored the same way. This site does not forward contact messages to an inbox.
+Why is a careful store not always 100?
Informational findings do not change the score. Grade A starts at 95. A few low findings leave a strong configuration in B.
+Does it read the Shopify theme?
No. Theme files and script tags inside the Shopify admin are not part of this public scan.