What does Vantyris check on my website?

Nine axes of cyber hygiene: TLS / HTTPS, web hygiene headers, DNS and domain plumbing, email authentication (SPF / DKIM / DMARC / MTA-STS / BIMI), exposure (open ports, sensitive files, WordPress hardening, subdomain enumeration), technology fingerprint, reputation lists, supply chain (third-party scripts + SRI), and privacy posture (consent, trackers, EDPB reject-parity, Consent Mode v2). Each axis is scored independently with its own grade.

Is a Vantyris scan legal? Can I scan my own website?

Yes. You can scan domains you own or have written authorisation to scan. Every Vantyris scan requires verified ownership (a DNS TXT record, a file on the server, or an HTML meta tag) before any active probe runs. The verification gate is what keeps us compliant with the UK Computer Misuse Act 1990 and the equivalent laws elsewhere.

How much does it cost?

Starter pack is €10 (≈£8) for 5 verified scans. Credits last 12 months. No subscription, no quote call, no annual contract. The free passive teaser is unlimited and requires no signup — paste a domain to see a partial grade in seconds.

What does the report actually contain?

Cover, one-page Executive Summary aimed at non-technical readers, Top Urgent Actions, nine-axis score breakdown, Attack Surface map with per-row severity + exact fix snippet for any exposed files, Fix Roadmap (Today / This Week / Later / Acknowledged), detailed findings each with a business-impact one-liner and a copy-paste remediation block, plus a Methodology + audit-trail appendix. Available in four PDF layouts: full editorial, executive one-page, single-issue work order, compliance pack.

Why is HSTS not flagged as a High urgent item in your report?

HSTS controls how long browsers remember to stay on HTTPS for your site. A short HSTS max-age is a hardening gap, not an emergency on its own — provided HTTPS is working, there's no mixed content, and the certificate is valid. We treat a very short HSTS (under one day) as Medium severity, anything else as Low. It's scored under TLS rather than Web Hygiene so the grades agree with each other.

Will a Vantyris scan slow my website down?

No. The teaser is a single page-load. The verified scan reads what's already publicly visible about your domain (DNS records, response headers, CT-log entries) and probes a small set of common sensitive paths with a 4-second timeout and bounded concurrency. We don't fuzz, brute-force, or run exploit frameworks. Real-world sites do not see measurable performance impact.

How is Vantyris different from SSL Labs or Security Headers?

Those are excellent free single-purpose tools — they answer one question well. Vantyris answers nine in one report, plus adds an attack-surface map, a Fix Roadmap grouped by who does the work, a one-page executive summary, Cyber Essentials A1-A5 alignment, CISA KEV priority scoring, share links, a public trust page, a portfolio dashboard, continuous monitoring, and a workspace API. Free tools answer 'is my config right?'; Vantyris answers 'how do I run a security baseline as a business owner, and how do I prove it?'

What's the Acknowledged bucket?

A new category in the Fix Roadmap for findings that need confirmation rather than action. Example: your resolved IP is on a shared Cloudflare edge that Spamhaus has listed — the listing is real, but it's shared-tenancy noise from another tenant on that IP, not something you can or should fix. Acknowledged sits below Today / This Week / Later so it doesn't make the report feel like an emergency over informational items.

Website security scanner for small business — UK

Know what's broken on your website. Before they do.

Vantyris checks your business website the way an attacker would — TLS, DMARC, DNS, WordPress hardening, exposed files, third-party scripts, privacy posture — then writes a plain-English report with a one-page executive summary, a Fix Roadmap grouped by who fixes it, and exact copy-paste remediation snippets.

A first answer in seconds. A verified report from £10. No contracts. No quote calls. UK-based.

Get a free check See a sample report

UK / EU

Data residency

OWASP

Methodology

UK-GDPR

Aligned

No subs

Pay as you scan

Demo targetbright-smile-dental.example

Findings

4/4

Scan time

71s

Modules

4/4

Sample output. Verified scan, fictional clinic, action required.

The reality

Small businesses don't have a security team. Attackers know it.

01
You have no security person.
You're a dentist, an accountant, an agency owner. You hired someone to build the website four years ago. You have no idea what's running on it now.
02
Every other tool talks past you.
CVE this, CVSS that. SAST, DAST, EASM. You don't care what it's called. You want to know if the door is open.
03
Or it costs £1,750 a month.
Or you do find a tool, and it wants a quote call, a twelve-month commitment, and your CFO's signature. For a one-off website check. No thanks.

The method

Paste a domain. Get an answer. Fix what matters.

01
Teaser
Paste a domain. A passive scan returns a partial grade in seconds. No signup, no card.
02
Verify
Add a DNS record, a file, or a meta tag. We only run a verified scan once you've proven ownership.
03
Scan
A first report arrives fast. Deeper checks stream in. You see what's happening, in real time.
04
Triage
Mark a finding fixed, accept it as known risk with a reason, assign it to your web host. Every change keeps an audit trail.
05
Rescan & prove
Re-run on a schedule or hand off a public trust page that shows your current grade to a customer or insurer.

Read the full methodology →

What you get

A workspace, not just a PDF.

The report is the artefact, but the workspace is the operating system around it. Triage, monitor, share, and prove. Built so a business owner can run their own security baseline without hiring a security person.

01
A report that names the fix, who does it, and when
Every finding has a plain-English explanation, a concrete fix, a typed owner (web host, developer, DNS admin, domain registrar, email provider), and a typed effort (5-10 minutes, 30 minutes, 1-2 hours, developer day, on next renewal). A Cyber Essentials alignment block maps each finding to the five NCSC controls.
02
A Fix Roadmap that turns the report into a worklist
Vantyris groups your findings into three buckets, today / this week / later, and within each bucket groups by owner. So your DNS admin gets one list, your developer gets another, and you get the 'today, fix in your hosting panel' list. Severity always wins: anything critical lands in today regardless of effort.
03
A 9-axis category grid that shows where you're strong and where you aren't
Nine axes covered: TLS, web hygiene, DNS, email security, exposure, technology, reputation, supply chain, privacy. Each gets its own score, grade, and severity counts. Healthy categories get a green tick, gap categories get a real number, not-assessed categories say so honestly. Same data shape powers the trust page.
04
An Attack Surface map, server-built from the same scan
What does the internet see when it looks at your domain? IPv4 + IPv6 addresses, nameservers and their provider, MX hosts, DNSSEC state, CAA issuers, registrar and lock state, domain age, subdomains discovered through Certificate Transparency logs. Typed, structured, one section of the report. Same data the NCSC EASM guidance tells boards to start with.
05
A triage workflow with an audit trail
Mark a finding fixed once you've patched it. Accept one as a known risk with a written reason (90-day auto-expiry so it isn't silently forgotten). Assign one to a contact email with a due date. Post comments. The status history is append-only so you can show an auditor what changed when.
06
A portfolio view for more than one site
Run an agency, a multi-brand business, or a few clinics? A portfolio dashboard shows every target ranked worst-first, average score across the workspace, and a one-click bulk re-scan that respects your credit balance. Export the lot to CSV for your client meeting.
07
Continuous monitoring with alerts only when it matters
Enrol a target in weekly, biweekly, or monthly re-scans. We alert by email only on the three things that actually move the needle: a new high/critical finding, a security score drop of 10 points or more, or a TLS certificate inside 14 days of expiry. No daily noise.
08
Sharing built for the real situations buyers face
Three ways to share a finished scan. A time-limited share link with an optional watermark, in full, executive, or evidence-redacted mode. A public trust page on a slug you choose, with a 9-axis category-coverage grid and a controls-in-place matrix, the URL you hand an insurer or a customer's procurement team. And the PDF, always, in full editorial, executive one-pager, single-issue work-order, or compliance-report layout.
09
An API for the people who script their security work
Workspace API keys with read or read-write scope. Endpoints to list targets and findings, filter by severity, category, workflow status, or owner. Drop into your CI pipeline or SOC dashboard with two lines of curl. The plaintext key is shown once at creation; revoke any time.

The artefact

Forwardable to your developer or your accountant.

Every finding has a plain-English "what this means", a concrete "how to fix", and the raw technical evidence one tap below.

Browse the full sample report →

Finding 02 / 11 · ExposureHigh severity

WordPress REST API exposes public user slugs

/wp-json/wp/v2/users returns the public WordPress user slugs for any account that has authored content. These slugs are commonly fed into automated tools before credential-stuffing or password-spray attempts against /wp-login.php.

Business impact: easier brute-force and credential stuffing.

Exact fix — drop into your theme's functions.php

add_filter('rest_endpoints', function ($endpoints) {
  if (isset($endpoints['/wp/v2/users'])) {
    unset($endpoints['/wp/v2/users']);
  }
  return $endpoints;
});

Time-to-fix: ~30 min · Owner: web developer · Confidence: high

What we check

Nine questions about your website, in plain English.

The report scores your site across nine axes (TLS, web hygiene, DNS, email, exposure, technology, reputation, supply chain, privacy) and explains each one the way you'd brief your web host. The acronym in small grey type at the end is for the engineer if you have one.

01
Is your padlock real, and is it telling the browser to stay locked?
The padlock in the address bar is supposed to mean the connection is private. We check whether yours actually is, whether the certificate is healthy and won't expire next week, and whether the HSTS header tells browsers to stay on HTTPS for the next two years. We don't treat a short HSTS as an emergency on its own — it's a hardening gap, not a downgrade in progress.
Technical: TLS handshake, cipher suites, certificate chain + expiry, HSTS (incl. preload-eligibility), OCSP stapling, mixed-content references.
02
Is your visitor's browser being told what to do?
Modern browsers will defend a website against common attacks, but only if the website tells the browser to. We check the response headers — CSP, X-Frame-Options, Permissions-Policy, Referrer-Policy, cookie flags — and parse them for the gotchas (`unsafe-eval` in CSP, wildcard camera permissions, missing Secure cookies). Most small-business sites have all of these off because nobody knew to turn them on.
Technical: Content-Security-Policy, X-Frame-Options, Permissions-Policy parsing for wildcards, Referrer-Policy, Cross-Origin Opener/Embedder/Resource Policies, cookie flags.
03
Can someone hijack your domain name?
Beyond the records that protect your email, your domain has a few other settings that decide who is allowed to issue certificates for it, whether old forgotten subdomains are still reachable, whether DNSSEC validates, and whether your transfer lock is on. We check those. Most domain hijacks happen because the transfer lock was never enabled.
Technical: CAA records, DNSSEC validation, A/AAAA/MX records, nameserver provider diversity, registrar transfer/delete lock state, domain age + expiry.
04
Can a stranger send email pretending to be you?
If your domain doesn't have the right DNS records, anyone can send an invoice from "accounts@yourbusiness.co.uk" and it will land in your customer's inbox looking real. We check whether your domain blocks this — SPF (and whether you're over the 10-lookup RFC limit), DKIM signing, DMARC policy and subdomain policy, BIMI logo + VMC, MTA-STS, TLS-RPT. Email impersonation is the single highest-impact thing a small business can fix.
Technical: SPF (incl. 10-lookup check + sp=/pct= subtleties), DKIM, DMARC alignment + policy + reporting, BIMI logo cert, MTA-STS enforce vs testing, TLS-RPT.
05
Anything on your server that shouldn't be reachable from the internet?
A database, an admin login page, a forgotten /readme.html, a /env file, a /backup.zip in the docroot, a dangling WordPress REST API exposing user slugs, an XML-RPC endpoint waiting for a brute-force amplifier. We probe a curated set of paths and report each one with the HTTP status, the severity, why it's sensitive, and an exact copy-paste fix snippet. Real-world wins are usually here.
Technical: bounded port discovery, ~71 sensitive-file probes (.env, .git, backups, DB dumps, debug endpoints, devops tools, WordPress hardening), subdomain enumeration via CT logs, subdomain-takeover risk via dangling CNAMEs.
06
What does your stack reveal about itself?
Every site tells attackers something about what's running on it. Sometimes that's just a CMS name. Sometimes it's the exact WordPress version, the outdated jQuery 1.12.4 still being loaded, or a Server header bragging about Apache 2.2.15. We fingerprint the public surface so you know what you're advertising — and flag the version banners worth removing.
Technical: CMS + framework + server + analytics fingerprinting, version disclosure in headers/HTML, X-Powered-By exposure, outdated jQuery/Bootstrap/CMS major-version flags.
07
Is your domain flagged by anyone's safety list?
Even if your site is clean today, an old subdomain that got compromised once can sit on Google Safe Browsing, Spamhaus, or SURBL for months. We check the major reputation lists. When the only hit is a shared CDN edge (Cloudflare, Fastly, Akamai), we flag it Acknowledged rather than urgent — the customer can't act on a shared-tenancy listing and probably doesn't need to.
Technical: Google Safe Browsing v4 (malware / phishing / unwanted-software), Spamhaus ZEN + DBL, Barracuda, SpamCop, SURBL, URIBL, urlscan.io malicious-history + brand-impersonation classifier.
08
Could a third-party script betray your visitors?
Most sites load five to twenty external scripts — analytics, ads, fonts, A/B tools, payment SDKs. Each one is a supply-chain risk: if their CDN gets compromised, your site executes whatever they ship next. We map your third-party surface, check each script tag for a Subresource Integrity hash, and flag the supply chain a regulator (or an attacker) would notice first.
Technical: third-party domain enumeration, Subresource Integrity per script + stylesheet, document.write detection, suspicious-CDN flagging.
09
Does your site meet the baseline privacy expectations?
Trackers before consent, a cookie banner that doesn't offer a visible Reject button on the first layer (EDPB enforcement notice territory), Google Analytics without Consent Mode v2 default-denied, missing privacy notice — under UK-GDPR and the ePrivacy Directive, these are real liabilities. We check the lightweight surface a regulator or savvy visitor would notice first.
Technical: pre-consent tracker detection, cookie-banner presence + EDPB reject-parity check, Google Consent Mode v2 detection, privacy-policy link presence, IAB TCF signal, visible contact route.

The rates

Pay only for what you scan.

No contracts. No quote call. One credit = one verified scan. Credits valid 12 months.

Single urgent check
5 verified scans · €2.00 per scan
€10
Buy this pack →
Small business bundle
Most chosen
40 verified scans · €1.25 per scan
€50
Buy this pack →
Agency / team bundle
300 verified scans · €0.83 per scan
€250
Buy this pack →

See all six packs & Shield Plan →

No subscription required. Shield Plan is optional.

Who it's for

Delivery

How you receive your report.

01Credits load instantlythe moment payment confirms.
02Your verified scan starts immediatelywhen credits are available.
03A first report appears in the workspacewithin ~90 seconds; deeper modules stream in.
04Email confirmation arrivesfrom noreply@vantyris.com with a link to the report.
05Three PDF layouts download with one clickfull editorial, single-page executive, or a single-issue work order.
06A time-limited share linkwith optional watermark and three content modes, lets a recipient view without an account.
07A public trust pageat a slug you choose lets a customer or insurer check your current grade themselves.
08A workspace API keylets your CI pipeline or SOC dashboard read targets and findings programmatically.

Common questions

The eight questions every owner asks before scanning.

What does Vantyris check on my website?: Nine axes of cyber hygiene: TLS / HTTPS, web hygiene headers, DNS and domain plumbing, email authentication (SPF / DKIM / DMARC / MTA-STS / BIMI), exposure (open ports, sensitive files, WordPress hardening, subdomain enumeration), technology fingerprint, reputation lists, supply chain (third-party scripts + SRI), and privacy posture (consent, trackers, EDPB reject-parity, Consent Mode v2). Each axis is scored independently with its own grade.
Is a Vantyris scan legal? Can I scan my own website?: Yes. You can scan domains you own or have written authorisation to scan. Every Vantyris scan requires verified ownership (a DNS TXT record, a file on the server, or an HTML meta tag) before any active probe runs. The verification gate is what keeps us compliant with the UK Computer Misuse Act 1990 and the equivalent laws elsewhere.
How much does it cost?: Starter pack is €10 (≈£8) for 5 verified scans. Credits last 12 months. No subscription, no quote call, no annual contract. The free passive teaser is unlimited and requires no signup — paste a domain to see a partial grade in seconds.
What does the report actually contain?: Cover, one-page Executive Summary aimed at non-technical readers, Top Urgent Actions, nine-axis score breakdown, Attack Surface map with per-row severity + exact fix snippet for any exposed files, Fix Roadmap (Today / This Week / Later / Acknowledged), detailed findings each with a business-impact one-liner and a copy-paste remediation block, plus a Methodology + audit-trail appendix. Available in four PDF layouts: full editorial, executive one-page, single-issue work order, compliance pack.
Why is HSTS not flagged as a High urgent item in your report?: HSTS controls how long browsers remember to stay on HTTPS for your site. A short HSTS max-age is a hardening gap, not an emergency on its own — provided HTTPS is working, there's no mixed content, and the certificate is valid. We treat a very short HSTS (under one day) as Medium severity, anything else as Low. It's scored under TLS rather than Web Hygiene so the grades agree with each other.
Will a Vantyris scan slow my website down?: No. The teaser is a single page-load. The verified scan reads what's already publicly visible about your domain (DNS records, response headers, CT-log entries) and probes a small set of common sensitive paths with a 4-second timeout and bounded concurrency. We don't fuzz, brute-force, or run exploit frameworks. Real-world sites do not see measurable performance impact.
How is Vantyris different from SSL Labs or Security Headers?: Those are excellent free single-purpose tools — they answer one question well. Vantyris answers nine in one report, plus adds an attack-surface map, a Fix Roadmap grouped by who does the work, a one-page executive summary, Cyber Essentials A1-A5 alignment, CISA KEV priority scoring, share links, a public trust page, a portfolio dashboard, continuous monitoring, and a workspace API. Free tools answer 'is my config right?'; Vantyris answers 'how do I run a security baseline as a business owner, and how do I prove it?'
What's the Acknowledged bucket?: A new category in the Fix Roadmap for findings that need confirmation rather than action. Example: your resolved IP is on a shared Cloudflare edge that Spamhaus has listed — the listing is real, but it's shared-tenancy noise from another tenant on that IP, not something you can or should fix. Acknowledged sits below Today / This Week / Later so it doesn't make the report feel like an emergency over informational items.

48 more questions on the FAQ page →

Get a first check in seconds.

Free passive teaser, no card. A verified scan from €10. No contracts.

Start free check See rates

Know what's broken on your website. Before they do.

Small businesses don't have a security team. Attackers know it.

You have no security person.

Every other tool talks past you.

Or it costs £1,750 a month.

Paste a domain. Get an answer. Fix what matters.

Teaser

Verify

Scan

Triage

Rescan & prove

A workspace, not just a PDF.

A report that names the fix, who does it, and when

A Fix Roadmap that turns the report into a worklist

A 9-axis category grid that shows where you're strong and where you aren't

An Attack Surface map, server-built from the same scan

A triage workflow with an audit trail

A portfolio view for more than one site

Continuous monitoring with alerts only when it matters

Sharing built for the real situations buyers face

An API for the people who script their security work

Forwardable to your developer or your accountant.

WordPress REST API exposes public user slugs

Nine questions about your website, in plain English.

Is your padlock real, and is it telling the browser to stay locked?

Is your visitor's browser being told what to do?

Can someone hijack your domain name?

Can a stranger send email pretending to be you?

Anything on your server that shouldn't be reachable from the internet?

What does your stack reveal about itself?

Is your domain flagged by anyone's safety list?

Could a third-party script betray your visitors?

Does your site meet the baseline privacy expectations?

Pay only for what you scan.

Built for owners. Loved by their developers.

Clinics & practices

Accountants & bookkeepers

Agencies & freelancers

How you receive your report.

The eight questions every owner asks before scanning.

Get a first check in seconds.