Skip to content
Check a domain

For web agencies

A check for every handover.From $2.95 a site before tax.

Hand over with confidence: HSTS, DMARC and cookie flags checked before the client looks.

Where it fits

Three moments.One credit each.

A report the client understands at a glance.

  1. 01

    Before you hand over

    Run it the day you go live. Fix the quick wins while the project is open.

  2. 02

    After every change

    Confirm everything still holds after migrations, plugin updates and DNS changes.

  3. 03

    When a client asks

    Send the report: what was checked, what was found, what to do.

What you get

Proof the client can check.Fixes their developer can apply.

Public information only, from a scanner that says who it is.

  • Up to 20 sites an order

    The calculator shows packs and leftovers before you pay.

  • Evidence on every finding

    The client's developer can check it for themselves.

  • PDF and JSON exports

    PDF for the handover, JSON for your own tracking.

  • Re-checks that compare

    Re-check a site and the saved report shows what is new, fixed and still open since the last comparable scan.

The maths

Packs of 1, 5 and 20.Leftovers keep for 12 months.

Twenty sites: one 20-pack, $59 + tax, $2.95 a site.

Price any number in the calculator
Credits used and left over, by order size
SitesPacks (credits)Left for re-checksBefore tax
51 × 50$18
122 × 5 + 2 × 10$52
201 × 200$59

Prices in USD before tax: simple pack arithmetic.

Real format

Findings your client can read.Evidence your developer can verify.

Open the full sample report

F4 · security-headers

Tell browsers to always use HTTPS

Low Confirmed Minutes

What it means
An HSTS header sends browsers straight to https://, even when a visitor types your address without it, so after the first visit, every return visit goes straight to an encrypted connection. Adding your site to the HSTS preload list covers the very first visit too.
Evidence
Strict-Transport-Security: (header absent)
Expected
Strict-Transport-Security: max-age=31536000; includeSubDomains
Fix
Send Strict-Transport-Security: max-age=31536000; includeSubDomains once every subdomain works over HTTPS.

F2 · cookie-flags

Keep the login cookie on HTTPS

Medium Confirmed Minutes

What it means
The session cookie is set without the Secure flag. Adding it keeps the cookie on encrypted connections, so signed-in sessions stay private, even on public Wi-Fi.
Evidence
Set-Cookie: PHPSESSID=…; path=/
              ↑ no Secure, no HttpOnly
Expected
Set-Cookie: PHPSESSID=…; path=/; Secure; HttpOnly; SameSite=Lax
Fix
Add the Secure and HttpOnly flags (and SameSite=Lax) to session cookies. In PHP: session.cookie_secure = 1 and session.cookie_httponly = 1.

Questions

Agency questions.

Something else? support@scandefend.com

How many sites can I check at once?

Up to 20 websites in one order. The pricing calculator shows the packs and leftover credits before you pay.

Do I need the client's permission?

There's no ownership-verification step, so you can check a client's site straight away. You stay responsible for any permission the law, your contract or the site owner requires (see the Scan Authorization Terms), and site owners can opt out at any time.

Do you offer white-label reports, scheduled re-checks or an API?

Today every report exports as PDF and JSON, ready to hand over. Want white-label, scheduled re-checks or an API? Tell us at support@scandefend.com: your requests shape what we build next.

Can I hand the report to a client?

Yes. Export it as PDF for the handover or JSON for your own tracking. Every finding carries the evidence their developer can verify.

Keep exploring

Also useful: Website security check ScanDefendBot Pricing

See what your website shows.Know what to fix first.

See pricing