Website security scanner for small business
Vantyris checks your business website the way an attacker would, then writes the report in plain English: a one-page summary, a Fix Roadmap grouped by who does each fix, and the exact snippet to paste for each one.
A first answer in seconds. A verified report from $10€10£10A$15¥1,500AED 40. No contracts.
Each panel mirrors a screen in your workspace, shown with our demo clinic. After your first scan, it's your sites and your findings.
Checked against
The reality
Maybe you run a dental practice or an accountancy firm. Someone built the website four years ago, and you have no idea what's running on it now.
CVE this, CVSS that. SAST, DAST, EASM. You don't care what it's called. You want to know if the door is open.
That's the published price of UpGuard's Standard plan, billed annually (upguard.com/pricing, checked 2 October 2026). Other tools want a quote call and a twelve-month contract before you see anything. For a website check, that's too much.
What you get
The report is what you forward. The workspace is where you track what happens next: mark fixes, schedule re-scans, share a link, show an insurer your grade. It's built so a business owner can run a security baseline without hiring a security person.
Fix Roadmap
Vantyris sorts findings into Today, This Week and Later, then groups each bucket by owner. Your DNS admin gets one list, your developer another, and you get the short 'fix it in your hosting panel today' list.
Learn moreShare and trust page
A time-limited share link with an optional watermark, in full, executive or evidence-redacted mode. A public trust page on a slug you choose, showing the nine-category grid and the controls in place: the link you give an insurer or a customer's procurement team.
Learn morePortfolio
Running an agency, several brands or a handful of clinics? The portfolio dashboard ranks every target worst first, shows the average score across the workspace, and re-scans the lot in one click within your credit balance.
Learn moreMonitoring
Enrol a target in daily, weekly, biweekly or monthly re-scans. We email you about three things only: a new high or critical finding, a security score drop of 10 points or more, or a TLS certificate within 14 days of expiry.
Learn moreEvery finding comes with an explanation in plain English, a concrete fix, an owner (web host, developer, DNS admin, domain registrar or email provider) and an effort estimate (5-10 minutes, 30 minutes, 1-2 hours, a developer day, or at next renewal).
Nine categories: TLS, web hygiene, DNS, email security, exposure, technology, reputation, supply chain and privacy.
What does the internet see when it looks at your domain?
Mark a finding fixed once you've patched it.
Workspace API keys with read or read-write scope.
The artefact
Every finding says what it means in plain English and how to fix it. The raw technical evidence sits one tap below.
/wp-json/wp/v2/users returns the public WordPress user slugs for any account that has authored content. These slugs are commonly fed into automated tools before credential-stuffing or password-spray attempts against /wp-login.php.
Business impact: easier brute-force and credential stuffing.
Exact fix: drop into your theme's functions.php
add_filter('rest_endpoints', function ($endpoints) {
if (isset($endpoints['/wp/v2/users'])) {
unset($endpoints['/wp/v2/users']);
}
return $endpoints;
});Time-to-fix: ~30 min · Owner: web developer · Confidence: high
What we check
The report scores your site across nine axes (TLS, web hygiene, DNS, email, exposure, technology, reputation, supply chain, privacy) and explains each one the way you'd brief your web host. The acronym in small grey type at the end is for the engineer if you have one.
highYour server still allows TLS 1.0 or TLS 1.1
The padlock in the address bar is supposed to mean the connection is private. We check whether yours actually is, whether the certificate is healthy and won't expire next week, and whether the HSTS header tells browsers to stay on HTTPS for the next two years. A short HSTS on its own is a hardening gap. It doesn't mean a downgrade is in progress.
mediumNo Content-Security-Policy
Modern browsers will defend a website against common attacks, but only if the site asks them to. We read your response headers (Content-Security-Policy, X-Frame-Options, Permissions-Policy, Referrer-Policy and cookie flags) and look for the gotchas: unsafe-eval in the CSP, wildcard camera permissions, cookies without the Secure flag. If none of these are set on your site, it's usually because nobody knew to turn them on.
mediumNo registrar transfer lock
Beyond the records that protect your email, your domain has a few other settings that decide who is allowed to issue certificates for it, whether old forgotten subdomains are still reachable, whether DNSSEC validates, and whether your transfer lock is on. We check those. The transfer lock is easy to overlook, and it's what stops your domain being moved to another registrar without your say-so.
highNo DMARC policy
If your domain doesn't have the right DNS records, anyone can send an invoice from "accounts@yourbusiness.co.uk" and it will land in your customer's inbox looking real. We check whether your domain blocks this: SPF (and whether you're over the 10-lookup RFC limit), DKIM signing, DMARC policy and subdomain policy, BIMI logo + VMC, MTA-STS, TLS-RPT. If you fix one thing on this page, fix this.
critical.env file is publicly accessible
A database, an admin login page, a forgotten /readme.html, an .env file, a /backup.zip in the docroot, a WordPress REST API handing out user slugs, an XML-RPC endpoint waiting for a brute-force amplifier. We probe about 70 known paths and report each hit with its HTTP status, its severity, why it matters and the exact fix to paste. If you read one section of the report closely, make it this one.
mediumOutdated jQuery loaded
Every site tells attackers something about what's running on it. Sometimes that's just a CMS name. Sometimes it's the exact WordPress version, the outdated jQuery 1.12.4 still being loaded, or a Server header bragging about Apache 2.2.15. We fingerprint the public surface so you know what you're advertising, and flag the version banners worth removing.
criticalDomain on Google Safe Browsing list
Even if your site is clean today, an old subdomain that got compromised once can sit on Google Safe Browsing, Spamhaus, or SURBL for months. We check the major reputation lists. When the only hit is a shared CDN edge (Cloudflare, Fastly, Akamai), we mark it Acknowledged rather than urgent. You can't act on a listing you share with every other site on that address, and you probably don't need to.
mediumExternal scripts loaded without Subresource Integrity
Your site probably loads scripts from other companies: analytics, ads, fonts, A/B testing tools, payment SDKs. Each one is a supply-chain risk. If their CDN is compromised, your site runs whatever they ship next. We list every outside script, check each one for a Subresource Integrity hash, and put the riskiest at the top.
highTracking scripts load without a consent banner
Trackers that fire before consent. A cookie banner with no Reject button on the first layer, the kind of thing EDPB enforcement notices cite. Google Analytics without Consent Mode v2 defaulting to denied. No privacy notice at all. Under UK-GDPR and PECR these are real liabilities, and they're what a regulator or a sharp-eyed visitor spots first.
The rates
No contracts. No quote call. One credit = one verified scan. Credits valid 60 days.
5 scans
One site, one urgent check · $2.00€2.00£2.00A$3.00¥300AED 8.00 per scan
$10€10£10A$15¥1,500AED 40
40 scans
SuggestedRegular re-scans across a few domains · $1.25€1.25£1.25A$1.88¥188AED 5.00 per scan
$50€50£50A$75¥7,500AED 200
300 scans
Agencies and teams · $0.83€0.83£0.83A$1.25¥125AED 3.33 per scan
$250€250£250A$375¥37,500AED 1,000
No subscriptions at all. Nothing renews.
Built to be checked
A public trust page shows your current grade and the controls in place. Send the link to a customer's procurement team or your insurer, and they can check it themselves.
Cyber Essentials A1-A5
A Cyber Essentials block maps each finding to the five NCSC controls.
CISA KEV priority
Severity is weighed against the Known Exploited Vulnerabilities list.
Append-only audit trail
Every status change is kept, so you can show an auditor what changed when.
EU data residency
Scans and reports are stored on servers in the EU, under GDPR.
Who it's for
Dental, GP, vet, physio. Patient data on your booking system, and what regulators ask about it.
Read the briefYear-end pressure, client portals and the tax software stack. The hygiene check your firm attaches to its engagement letter.
Read the briefScan every client site from one workspace, with a PDF and a share link for each client. Top up credits when you need them.
Read the briefDelivery
Common questions
Free account, free passive teaser, no card. A verified scan from $10€10£10A$15¥1,500AED 40. No contracts.