What can anyone see on your website that an attacker would use?
Enter your site. In about a minute you get a plain-words report: what we found, why it matters, how to fix it, and a score. It is private to you.
What the free check does, and what it never does
It reads only what a browser sees on a normal visit
- The HTTPS certificate and when it ends
- Security headers and cookie settings
- Files loaded over plain http on an https page
- Third-party scripts, and versions with public security advisories
- Key-like strings in the public JavaScript your home page loads
- Email spoofing records in DNS: SPF, DKIM, DMARC
- robots.txt, sitemap.xml, llms.txt and security.txt
It never does this
- Guess hidden pages or files
- Try to log in, or fill in forms
- Send attack payloads or scan ports
- Load your site harder than one visitor: one request at a time, about 15 in all
- Publish your report, or name your site anywhere
A deeper check (exposed .git and .env files, backups, folder listings, admin pages, subdomain takeover) runs only after you prove you own the domain and agree to the deep-scan terms. Its results go only to you.
Own this site? Go deeper, and hear when something changes
Prove the domain is yours with a DNS record or a small file. Then you can run the deep check, and Beacon re-scans every week and tells you when something new appears, like a header dropped by a deploy or a certificate about to end.
Questions
Is this legal to run on any site?
The free check reads only what any visitor's browser receives, the same as opening the home page. That is why it needs no proof of ownership. The deep check looks for files that should not be public; it runs only on a domain whose owner has proved control and agreed to the terms.
Who can see my report?
Only you. The free report opens with a private link held in your browser (the part after # never reaches any server log). Owner and deep reports open only for the signed-in account that verified the domain. We never publish a report or name a site. When we write about what we see, we use only totals across many sites.
What does it cost?
The free check is free, 3 a day. The deep check on a site you have verified, and the weekly re-scan, are part of the paid plan; its price and what it includes are on /partners/scan/.
Is this a full security audit?
No. It catches the common, visible mistakes that automated attacks look for first. It does not replace a penetration test of your app's logic, logins and APIs.