Is this a replacement for a firewall or malware scanner?

No. This is external monitoring: it watches the surface a visitor and an attacker can both see, and reports what changes. It complements a WAF or a server-side scanner rather than replacing either.

What happens if a site's firewall blocks the scanner?

The scan says so explicitly and marks the results incomplete rather than clean. A blocked scan that reports no findings is the single most dangerous output a security tool can produce, so it is called out as its own finding with the fix (allowlist the scanner) attached.

Do you exploit or attempt to break into the sites?

No. Checks are read-only observations of publicly available responses. Nothing here attempts to bypass authentication or exploit a vulnerability it finds.

Security monitoring that shows its evidence

Security tooling has a credibility problem: it is easy to sell fear and hard to sell a finding someone can act on. The approach here is the opposite. Every check reports what it observed, attaches the evidence, and describes the fix. Where a signal is an indicator rather than a diagnosis, it says so in those words.

Detection is evidence, not accusation. Automated checks report indicators and show what they saw; they never declare a site compromised as settled fact, and no scanner can promise a site will not be attacked.

Monitor your first site See how it works

Interactive demoSample website, sample results

northwind.exampleRunning checks

QueuedRunning
AvailabilityWaiting
TLS and DNSWaiting
Security headers and contentWaiting
SEO and complianceWaiting
Report and status pageWaiting

Evidence appears here as each stage finishes. Nothing is shown before it is measured.

The checks that run

A daily sweep covers the surface an attacker looks at first, and each finding is deduplicated so the same issue does not re-announce itself every day until it is fixed.

Security headers and the transport-layer settings behind the padlock
Certificate expiry, chain validity and protocol configuration
Files that should not be publicly reachable but are
Published advisories matched against the components actually detected on the site
WordPress core, plugin, theme and PHP versions against current releases
DNS and email authentication records. SPF, DMARC, MX and nameserver drift

Early warning for unwanted content

Some compromises are invisible to the site's owner: pages served only to search-engine crawlers, a sitemap that suddenly grows by thousands of URLs, vocabulary appearing in the markup that nobody on the team wrote. These are checked for and reported as indicators with the evidence attached, so a person can confirm or dismiss them quickly.

Change you did not authorise

The records that decide where a domain's traffic and mail go are also the records an attacker changes first. Nameserver, MX and email-authentication changes are compared against the last known state and flagged when they move. A planned migration produces the same flag, which is the point: an unexpected change here is worth ten seconds of your attention.

Questions people ask

Is this a replacement for a firewall or malware scanner?: No. This is external monitoring: it watches the surface a visitor and an attacker can both see, and reports what changes. It complements a WAF or a server-side scanner rather than replacing either.
What happens if a site's firewall blocks the scanner?: The scan says so explicitly and marks the results incomplete rather than clean. A blocked scan that reports no findings is the single most dangerous output a security tool can produce, so it is called out as its own finding with the fix (allowlist the scanner) attached.
Do you exploit or attempt to break into the sites?: No. Checks are read-only observations of publicly available responses. Nothing here attempts to bypass authentication or exploit a vulnerability it finds.

Point it at a site you already know

One website is free, with the full product, the same checks, alerts, status page and monthly report. Adding a site whose history you already know is a fairer test of SiteIntact than any demo.

Monitor your first site