PromoPilot Shield

Find your site’s vulnerabilities
before someone else does

PromoPilot Shield scans your site for vulnerabilities — headers, TLS, exposed files, CMS vulnerabilities, SSRF and injections — and prepares a personal report with a CVSS rating and a remediation plan. It works with WordPress, Joomla, OpenCart and custom-built sites.

Free check · no installation · results in a minute

Login

What we check

Over 40 checks following the OWASP methodology — safely, without exploiting anything.

Headers and TLS

HSTS, CSP, X-Frame-Options, certificate state, outdated protocols, cookie flags.

Leaks and exposed files

.git, .env, backups, phpinfo, directory listings, disclosure of software and CMS versions.

Injections and SSRF

The attack surface for XSS, SQL injection, open redirects and SSRF (parameters that fetch URLs).

CMS vulnerabilities

Engine and version detection, known vulnerabilities, exposed admin panels, XML-RPC, user enumeration.

DNS and mail

SPF, DKIM, DMARC, CAA — protecting the domain from forged mail and spoofing.

AI report

An expert breakdown of the findings in plain language, a business risk assessment and a step-by-step remediation plan.

The full list of checks

Over 40 automated checks following the OWASP methodology — safely, without exploiting anything.

Security HeadersHSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy
TLS and certificateCertificate validity and expiry, outdated TLS 1.0/1.1, the HTTP→HTTPS redirect, HSTS
CookiesThe Secure, HttpOnly and SameSite cookie flags
Information leaks.git, .env, backups, phpinfo, server-status, directory listings, software version disclosure
CMS vulnerabilitiesEngine and version, config files (wp-config/local.xml), installers left in place, debug logs, XML-RPC, user enumeration, outdated versions
DNS and mailSPF, DKIM, DMARC, CAA — protection against forged mail
CORS and contentInsecure CORS, clickjacking, mixed content, vulnerable JS libraries
Injections and SSRFReflected XSS, signs of SQL injection, open redirects, the SSRF surface (parameters that fetch URLs)
APIExposed endpoints, GraphQL, verbose errors, access without authorisation

Simple plans

One-off checks from your shared balance, or a subscription for regular monitoring.

Quick check
Free
  • Headers, TLS, cookies
  • DNS and version leaks
  • An A–F rating
Deep scan
$19
  • All checks
  • CMS vulnerabilities, SSRF, injections
  • AI report plus PDF
Monitoring
Subscription
  • Regular rescans
  • Alerts about new threats
  • Certificate monitoring
Check my site

Scanning is performed only for sites whose owner has confirmed the right to check them.