Auditly
Security audit · by URL

Find what an attacker would find on your site, before they do.

Auditly scans your domain with 18 modules covering headers, TLS, cookies, secrets and files, and flags each vulnerability with its fix.

Real probes, not a checklist.

Auditly actively probes your URL for injection, CORS and secrets in the JS, and reports each weak point with its fix.

A verdict, its severity, and the exact fix.

The report prioritizes what to resolve first with KEV and EPSS, in plain language and ready to share.

Find it today. Not an attacker tomorrow.

A full scan in minutes, on a domain you verify, with the PDF in your inbox.

Full scan: US$29 per domain, paid after verification.

We only scan domains verified by their own owner.

Not ready to verify? Try the free preview →
https://example.com
1Missing CSP
2Cookie without HttpOnly
3CORS: *
4.env exposed
✓Valid TLS
B+Security grade
headers›tls / certificate›cookies›cors›secrets in js›.env/.git files›vulnerable libraries›firebase rules›xss/sqli injection›source maps›rate limiting›headers›tls / certificate›cookies›cors›secrets in js›.env/.git files›vulnerable libraries›firebase rules›xss/sqli injection›source maps›rate limiting›
18check modules per scan
Minutesfrom scan to PDF
KEV·EPSSreal CVE prioritization
EN·ES·FR·PTreport in four languages
Process

How it works

Three steps, in this order: no scan gets queued until the first two are confirmed.

  1. Add a DNS TXT record or upload a file to your site's root. We confirm you control the infrastructure before touching it. If it doesn't match, we show you exactly what's wrong and you try again. Nothing is charged until the domain is verified.

    auditly-verify=3f9a…

  2. Payment is verified first. The job only gets queued once the gateway confirms it, never before.

    $29 USD · one-time

  3. A summary lands in your inbox and the full PDF report follows, usually within minutes.

    auditly-example.com.pdf
What we check

Every check maps to a real attack surface

The same checks the desktop product runs, straight against your site.See all 18 modules and the limits they run under →

example.comDOMINIO
B+
HeadersCSP, HSTS
TLScertificado
Cookiesflags
CORSorigin
SecretosJS / keys
Archivos.env / .git
  • ConfigurationHeaders and TLS: CSP, HSTS, clickjacking, cookies without flags, certificates and HTTP-to-HTTPS redirects.
  • InjectionXSS, SQLi and CORS: Active probes on parameters and forms, plus misconfigured cross-origin policies.
  • High impactExposed secrets: API keys, tokens and credentials leaked in client-side JavaScript or in accessible files.
  • ExposureSensitive files: .env, .git, backups and admin paths that should never be public.
  • DependenciesVulnerable libraries: Front-end versions with known CVEs, cross-checked against KEV and EPSS to prioritize.
  • BackendFirebase rules: Collections with anonymous reads and permissive real-time security rules.
// A report that reassures

You finding it today is a fix. An attacker finding it is a breach.

The scan runs live and the report prioritizes what to resolve first, in plain language. Not to scare you: so you can act in time, with a plan and the calm of knowing exactly where you stand.

  • A clear verdict and a security grade
  • Findings ordered by severity
  • How to fix each one, step by step
  • Downloadable PDF, ready to share

Every finding comes with the evidence we observed, why it matters and the exact change that fixes it, ordered so you know what to do first.

AuditlySecurity audit reportexample
No critical or high-severity issues found6 lower-severity findings. See recommended fixes below.
B+
MEDIUM

Add a Content-Security-Policy header

No CSP is set, so an injected script would run with full page privileges.
MEDIUM

Replace Access-Control-Allow-Origin: * with an allowlist

A wildcard lets any site's JavaScript read this response, which is fine for public data but risky if anything is user-specific.
LOW

Add a Referrer-Policy

Full URLs, including tokens, can leak to third parties via the Referer header.
LOW

Add X-Content-Type-Options: nosniff

Without it, some browsers may MIME-sniff and render a response as HTML/JS.
LOW

Add a Permissions-Policy

Powerful browser APIs stay available by default to any script running on the page.
// For security consultancies

Audit SMBs? Do it at scale with Auditly Desktop.

The same scan engine, in a desktop app for your team. Audit clients in any sector and deliver reports under your own brand.

  • Local or shared network mode
  • Reports under your brand
  • Clients in any sector
  • The same engine as the web
About Auditly Desktop →
Auditly Desktop: open findings across client projects, grouped by severity
// Partner program

Become an Auditly partner

Resell audits, fold Auditly into your service offering, and access partner pricing. For agencies, consultancies and MSPs that want to add security to their portfolio.

I want to be a partner →