Read-only. No attack traffic.
SUScanner reads what your site already hands out to anyone who asks — headers, certificate, DNS, and 38 file paths attackers check first — and tells you, in plain language, what it found and how to fix it.
A full database backup is publicly downloadable
CriticalYour security certificate expired 11 days ago
HighYour login cookie can be read by any script on the page
MediumYour server announces its exact version number
LowGrade B — one thing needs fixing today
4 findings · WordPress on nginx · read-only checks
One finding, two readers
Most scanners produce a PDF nobody in a ten-person business can act on. Every SUScanner finding is written twice — once for the person who owns the company, once for whoever actually touches the server.
What the owner reads
Anyone on the internet can download a complete copy of your database from your own website. That file contains every customer record, address and order you've ever taken.
Why it matters
Nobody needs to break in. They just click the link.
What the developer reads
GET /backup.sql → 200 OK content-type: application/octet-stream content-length: 43,118,592 body starts: "-- MySQL dump 10.13"
Fix — nginx
rm /var/www/lotus/backup.sql
location ~* \.(sql|bak|old|zip)$ {
return 404;
}
# then: nginx -t && systemctl reload nginx
Before a single packet leaves
Scanning a site you don't own is an offence under the IT Act. So the scanner refuses to, structurally — not by policy, and not once per scan, but before every single request it makes.
You prove the domain is yours with a DNS record, a file, or a meta tag. Unverified domains cannot be scanned at all.
Government, banking and major platform infrastructure is refused even if someone somehow verifies it.
Every resolved IP must be publicly routable — so nobody can point a domain at an internal address and use us to reach inside a network.
Pricing