Before an enterprise prospect signs, someone checks you out. They read your certificate, your headers, your privacy page, and whether anyone can send mail as you. This is that check, run from outside exactly as they would run it, with every gap ranked and costed.
One site, read once. Nothing is logged into, attacked, or changed.
What a cautious buyer verifies.
All of it visible from outside. That's the point, and the limit.
Certificate validity, chain of trust, protocol versions and HSTS — the things a browser checks silently and a buyer checks deliberately.
Check for Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and more.
DKIM, SPF, and DMARC validation — plus DNS configuration checks to prevent email spoofing and domain hijacking.
Admin panels, API endpoints, debug pages and config files that answer to anyone who asks, found the same way a stranger would find them.
Review cookie consent implementation, tracking scripts, third-party data sharing, and alignment with GDPR/CCPA requirements.
Every finding ranked by severity with estimated fix time — so your team knows what to patch first and how long it will take.
Real output from the pipeline. Velora is a fictional company, so we can show you the format without publishing a real business's security posture. Click any page to enlarge it.
Five domains scored — including the ones we could not verify, said plainly.
What it means in English, what it costs, and the config line that fixes it.
Ordered by return, not by cost — most of the top rows are free.
Then you have documented proof of that — which is the outcome most buyers are actually paying for. A clean or low-severity result is a complete finding, not an empty report: it tells you your public-facing posture holds up under assessment, and it gives you something concrete to put in front of a security-conscious prospect, a procurement questionnaire, or your own board.
This is a passive external assessment. Here is honestly where it sits against the alternatives.
Grades your headers in ten seconds and hands you a letter. No sense of which gap matters to a buyer, what it costs to close, or what to do on Monday.
Ranked, costed, and explained.
The real thing: authorised, active, and far deeper than anything observable from outside. It is also weeks of scheduling and five figures.
We come before one, never instead.
They audit from inside, where every endpoint is reachable and every control is known to be there. That is the one vantage point they cannot get.
The view from outside the building.
Procurement sent security questions and nobody owns the answers. This tells you what they will find and what to fix before they look.
You audit from inside, where everything is reachable. This is the view from the other side, and it sits before a pen test rather than instead of one.
Agencies and contractors: a dated, external record of a client site’s public posture, useful at handover and in the awkward conversation after it.
A structured, dated document of your public-facing posture for compliance reviews, board packs, and the questionnaire that arrives next quarter.
This audit asks whether your site looks safe enough to buy from. There is a question that comes earlier: whether anyone finds it at all.
Same outside-in method, pointed at visibility instead of trust: whether search engines can reach you, whether your content is deep enough to rank, and where competitors cover ground you do not.
No, and it does not replace one. This is a passive external assessment: it observes what any browser, search engine or visitor already sees, and nothing is logged into, attacked, or changed. A pen test is authorised, active, and goes far deeper than anything visible from outside. If you need one, the report says so. This is the pass you do first, and for most companies it finds the things a pen test would be wasted on.
No. Every request is unauthenticated and read-only, against endpoints that are already public. No credentials are used, no data is accessed or stored, and nothing on your site is modified. You do not need to warn your hosting provider or open a change window.
That is one of the main reasons people buy it. It is a dated, structured document of your public-facing posture, written to be read by someone who is not on your team. It is evidence of an external assessment, not a certification, and it does not claim to be one.
It is recorded as not testable rather than counted as a failure. A firewall that blocks a request is doing its job, and we credit it as such while still noting that it leaves us unable to confirm what sits behind it. Passive assessment cannot tell "control absent" from "control invisible", and a report that pretends otherwise is not worth reading.
Not to understand it. Every finding is written in business terms first and technical terms second, ranked by severity, with an estimate of the effort to fix. Plenty of the fixes are a DNS record or a header, which your developer or host can do in an afternoon.
Yes. It is a one-time purchase with no subscription and no per-seat licence. Circulate the PDF internally however you like.
See what they will find before they find it, ranked and costed. Delivered in hours, one-time, no subscription.
