Security-as-a-Service

Free website security scanner
Your host keeps the server safe — we keep your website safe.

Sterlink Digital protects your WordPress, Laravel, Node, or any other stack at the application layer — and if any incident occurs, it immediately sends an email alert telling you what the hacker, bot, or fake email did. The scan runs from outside your server over HTTPS, so there is nothing to install and nothing for an attacker to disable. You get a score out of 100, the evidence behind every deduction, and the fix written for the exact file or header at fault.

Free website security scan

Enter any URL to check its SSL certificate, security headers and malware blacklist status — instantly, no signup required. The result includes the score, a plain verdict and the first fix steps, with no card and no trial timer attached.

One free preview scan: security headers, the SSL certificate and malware blacklists, with the score and a plain verdict. One run is included per signed-in account and one per domain for visitors who have not signed in. Sign in free to open the numbered fix steps and the copy-paste server config for your site. An account also brings the full report — exposed files, outdated software, XML-RPC, DNS records, monitoring and email alerts. Results appear the moment the run finishes, and the same domain can be scanned again from your dashboard whenever you want.

To keep the free scan working and stop abuse, we log your IP address and browser user agent with this request — see our Privacy Policy.

Start free scan · How it works

Bot blocked at /wp-login.php Fake email flagged Malware file found

yourstore.com

Waiting for scan

Press the scan button to see how a report reads.

Sample data for demonstration only. Your real report opens after the scan.

Your website in relax mode

Sterlink checks your site around the clock and only writes to you when something actually needs you — and by then the message already carries the fix, not just the news. Each check runs on the same schedule every time, so a change in the result always means something changed on your site. Nothing to install, nothing to babysit, and no dashboard you are expected to keep open.

Continuous remote scan

Security headers, SSL, exposed files, outdated versions, XML-RPC, DNS, and blacklist — all checked automatically. Runs on your schedule — daily or weekly — and again the moment you press Scan now. Each run is compared with the last one, so a regression shows up as a change rather than a surprise. Nothing is installed on your server, and no firewall rule is opened to let us in.

Real-time email alerts

If a suspicious login, malware file, or fake email shows up, you get an email right away telling you what happened and what to do — and a busy stretch arrives as one digest instead of a flood. Every alert names what happened, where it happened and when, in plain language rather than a severity code. The fix steps travel with the message, so you can act without opening a dashboard first. Per-type preferences decide what reaches your inbox and what simply waits in the app.

Fix guidance

Every alert comes with plain-language steps — which plugin to update, which file to delete, and which config to change. Steps are numbered for the exact file and line the finding points at, with copy-paste server configuration where one helps. Links into the knowledge base give the background when you want to understand the attack instead of only closing it. The next scan re-checks the fix, so nothing is marked resolved on trust.

One score for every site

A live 0–100 security score per site, graded from the same checks on every run, so you can compare your domains at a glance. Green means relax, and a drop tells you what changed before you read a single finding. The history keeps every score, so a slow slide is visible while it is still easy to reverse.

Report history you can share

Every scan is stored with its findings, evidence and score, so you can show what was fixed and when. Filter by site or severity, reopen any past run, and export the report for a client, a host or your own team. The history stays with the site even if you rename it later.

From URL to protected in three steps

No agents to install on your server and nothing to configure on the host. Sterlink works from the outside, the same way an attacker would look at your site — which is why it catches the things a server firewall never sees. Paste a URL, read the report, apply the fixes it lists; the next run confirms each one.

Enter your website URL

Paste the address of any site. The free preview scan needs no signup and finishes in seconds.

We scan and keep watching

Headers, SSL, exposed files, software versions, DNS and blacklists are checked automatically — then re-checked around the clock.

Get an email, then fix it

Each alert says what happened and lists the exact plugin, file or setting to change — in plain language, not in CVE codes.

What our website security scanner checks

Seven areas where a small gap turns into a real incident. Every one of them is checked on every run, and every failure comes back with the exact line to change — the header, the path, the version or the DNS record — so you never have to work out what a finding means before you can act on it.

Security headers

Content-Security-Policy, HSTS, X-Frame-Options, X-Content-Type-Options and Referrer-Policy — the five headers that close whole classes of XSS, clickjacking and downgrade attacks. The report names the exact header that is missing or weak and the value it should carry, not just a pass or fail. The fix includes the line to add to your server config or to your host panel.

Content-Security-Policy HSTS X-Frame-Options X-Content-Type-Options Referrer-Policy

SSL certificate

Missing HTTPS, expired or expiring certificates and self-signed certificates, with the issuer and an exact expiry date. Certificates expiring weeks ahead are flagged early, so renewal happens on your schedule instead of during an outage. Broken chains and protocols below the modern baseline are reported with the same detail.

Exposed files

Publicly reachable .env backups, .git directories, database dumps, phpinfo() pages and config backups that leak credentials and source code. Each one is reported with the URL that reaches it and what that file gives away, so the urgency is obvious at a glance. The fix says which path to block and which file to move out of the web root.

/.env.bak exposed
/.git/ exposed
/db-dump.sql exposed
/phpinfo.php exposed

Outdated software

WordPress and PHP versions below the supported baseline, plus generator tags and headers that disclose the exact stack to attackers. Known CVEs tied to those versions are listed next to the version itself, so you can see why an update matters rather than being told that one does. Disclosure findings explain which header or tag to remove.

XML-RPC, debug mode and directory listing

Open WordPress XML-RPC used for brute-force amplification, leaked stack traces from debug mode, and directories that list their own files. Each finding names the endpoint or path it was observed on, so you can reproduce it yourself in a browser. The fix gives the configuration that closes it without breaking the plugins that still need it.

DNS and malware blacklist

DNS record health, Spamhaus blocklist entries, and Google Safe Browsing flags for malware or phishing content on the site. A listing is reported with the source that raised it, so you can request a review the same day instead of guessing why traffic stopped. Missing or inconsistent records are flagged before they cost you mail or rankings.

Edge protection

Cloudflare settings that decide whether an attack reaches your site at all: SSL mode, minimum TLS version and the challenge security level. Where Cloudflare is detected, the scan reads your nameservers and reports the settings that are actually in force, not the ones you remember setting. The recommendation shows the value to change and what it protects against.

Your host guards the server. Sterlink guards your website.

Hosting security stops at the server. Attacks on your login page, your plugins and your config files happen one layer higher — and that is the layer Sterlink watches, from the outside, on every run. The two are complementary rather than competing: keep your host for the machine, and let this watch the application that runs on it.

Normal visitor Attack caught and reported

Host security

Sterlink Digital

What it protects

The server, the operating system and the network

Your website code, plugins, files and configuration

What it looks for

Server-level faults and network abuse

Weak headers, exposed files, old software, suspicious logins, blacklists

When something happens

Handled on the server side, often without telling you the details

An email with what happened and how to fix it

Who acts on it

Your host, on their schedule

You, the moment the alert lands

An alert that tells you what to do next

No dashboard to watch. When something happens, one email explains what the attacker did and gives you the steps to close the door, in the order to do them. A busy stretch arrives as a single digest instead of a flood, and each alert links straight to the finding so you can act without hunting for context.

Sterlink Digital alerts Suspicious login on yourstore.com/wp-login.php

High priority

What happened

Repeated failed logins from one IP address were followed by a successful sign-in to an admin account.

What to do

✓Reset the admin password
✓Turn on two-factor sign-in
✓Block the IP address at your firewall

Example alert for illustration.

The attacks Sterlink tells you about

Each one arrives as a plain-language email with the fix included — not a severity number you have to look up. The knowledge base entry behind every alert explains the attack itself, so you can decide how far to go rather than guessing.

Suspicious logins

Repeated failed sign-ins from one address, then a success. You see which account and which IP were involved.

Alert with fix steps

Malware files

A malware file turning up on your site triggers an alert that names the exact path to delete and how to restore a clean copy.

Alert with fix steps

Fake emails

Messages sent pretending to be you are reported with the DNS records that stop them — SPF, DKIM and DMARC, in the order to publish them.

Alert with fix steps

Bots and XML-RPC abuse

Automated traffic hammering your login page, or an open XML-RPC endpoint used to amplify password guessing, is spotted and explained.

Alert with fix steps

Exposed secrets

.env backups, .git folders, database dumps and phpinfo pages are reported with their exact public address, so you can fetch and delete them.

Alert with fix steps

Outdated software

Old WordPress, PHP or plugin versions are flagged with the exact update to run — including plugins with a known public exploit.

Alert with fix steps

Security tool, privacy-first

A scanner should not become another thing watching your visitors. Sterlink reads only what a public request would reveal and stores nothing about the people who reach your site.

No advertising trackers

There are no advertising or analytics trackers on this site. Nothing follows you to another page and nothing is sold on.

Only essential cookies

Cookies cover your session, your sign-in state and CSRF protection, and nothing else. You can clear the consent answer from the footer at any time.

Abuse logging, stated openly

The free scan logs your IP address and browser user agent to stop abuse. The Privacy Policy explains what is kept, for how long, and why.

Start free, go deeper when you need to

See the full plans, limits and prices on the pricing page. The free tier stays free, and every paid tier adds monitoring rather than taking away checks.

Free preview

For a quick look, no account

Security headers check
SSL certificate check
Malware blacklist status
Score and a plain verdict
One run per domain

Run free scan

Free account

Everything in the preview
Numbered fix steps
Copy-paste server config for your site
One preview run per account

Create free account

Full protection

Continuous monitoring and alerts

Exposed files and outdated software
XML-RPC and DNS records
Monitoring around the clock
Real-time email alerts and digests

See pricing

Learn the basics in the Knowledge Base

Short, practical guides on the things the scanner reports — what each one means for your site and how to close it without breaking anything.

Security headers explained

What CSP, HSTS and the other three headers actually block, and how to switch them on without breaking your forms or fonts.

Read guides

Why an exposed .env file is dangerous

How a leaked config file hands over database passwords and app keys in one request, and the three ways to close it for good.

Read guides

Hardening WordPress XML-RPC

Why an open XML-RPC endpoint doubles the value of a brute-force attack, and what to disable without breaking your editors.

Read guides

Questions people ask before scanning

Is the scan really free?

Yes. One free preview scan checks security headers, the SSL certificate and malware blacklists, and gives you a score with a plain verdict. It includes one run per signed-in account, and one per domain for visitors who have not signed in.

What do I get when I sign in?

Signing in free opens the numbered fix steps and the copy-paste server config for your site. An account also brings the full report: exposed files, outdated software, XML-RPC, DNS records, monitoring and email alerts.

Does Sterlink replace my host's security?

No. Your host keeps the server, the operating system and the network safe. Sterlink protects your website at the application layer — which is where plugins, logins and config files live, and where most real breaches start.

Which platforms does it work with?

WordPress, Laravel, Node.js, custom PHP, WooCommerce and static sites. Anything reachable over HTTP can be scanned; the connector plugin is WordPress-specific and optional.

How do alerts reach me?

By email, right away. If a suspicious login, malware file or fake email appears, the message says what happened and what to do about it. A busy stretch arrives as one digest instead of many emails.

Do you track me?

No advertising or analytics trackers are used. Only the cookies needed for your session, sign-in state and CSRF protection are set. The free scan logs your IP address and browser user agent to prevent abuse.

Will it slow my site down?

No. Scanning happens from the outside, on our side, at a rate your host will not notice — there is no plugin to install for scanning and no agent running in your pages. The optional WordPress connector only reports back; it does not intercept traffic.

What happens if I ignore a finding?

Nothing is changed on your site by us — we report, you decide. Findings stay in your report until they are resolved, and the ones that matter most keep appearing in the daily digest so they do not quietly get lost.

Works with your stack

From WordPress to custom Laravel/Node apps. If it answers over HTTP, we can scan it.

WordPress Laravel Node.js Custom PHP WooCommerce Static sites Drupal Joomla Magento Django WordPress Laravel Node.js Custom PHP WooCommerce Static sites Drupal Joomla Magento Django WordPress Laravel Node.js Custom PHP WooCommerce Static sites Drupal Joomla Magento Django WordPress Laravel Node.js Custom PHP WooCommerce Static sites Drupal Joomla Magento Django

View pricing

Scan your website free in under a minute

Check your SSL certificate, security headers and malware blacklist status right now. Sign in free to open the numbered fix steps and the copy-paste server config for your site.

Start free scan View pricing

Free website security scannerYour host keeps the server safe — we keep your website safe.