Start your 7-day free trial, card not charged until it ends

Full security scans on every domain

Find what attackers see, before they do

Run a security scan on any domain in your portfolio in one click. Open-port scanning, TLS audits, OWASP web vulnerability checks, WordPress-specific scans, subdomain discovery on a full scan, and an AI summary of the findings, all from your dashboard.

Start your free trial

Card not charged until your trial ends

01 · Why scan

Why running scans matters

If you manage more than a handful of domains, you can’t manually pentest each one every month. TLDTrack runs the heavy tooling for you, then summarises the findings in plain English.

See your real attack surface

Forgotten staging subdomain still exposed? Old Tomcat manager still on port 8080? We find the things you forgot were there, before someone else does.

CVE coverage without rule-writing

Scans run Nuclei templates for known CVEs, exposed files, default logins and misconfigurations. There are no rules for you to write.

Plain-English findings

Raw nmap, ZAP and nuclei output is fine for security engineers, but useless to most clients. Each scan comes with a plain-English summary of what was found, why it matters and what to fix first, so you can hand the report to a non-technical stakeholder.

Track posture over time

Every scan is stored against the domain, so you can see whether last quarter’s findings have been fixed and whether new ones have appeared. Useful for audits, board reports and SOC2 evidence.

02 · Coverage

What every scan covers

Each scan runs in an isolated Fargate container with industry-standard tooling. Nothing is shared between customers, nothing is cached.

Subdomain discovery

On a full scan, passive enumeration via CT logs and threat-intel feeds (subfinder) finds subdomains you forgot were there.

Port & service scan

Top-port nmap sweep to fingerprint what’s exposed: SSH versions, mail servers, admin panels, dev services accidentally left open to the internet.

TLS / SSL audit

Full testssl.sh pass: weak ciphers, deprecated protocols (SSLv3, TLS 1.0/1.1), known CVEs (Heartbleed, ROBOT, POODLE), certificate chain issues, HSTS posture.

Security headers

CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy. Graded with specific suggestions for missing or weak directives.

Tech fingerprinting

whatweb + httpx detection of CMS (WordPress, Drupal, Joomla), frameworks, web servers, WAFs. Drives the targeted checks that come next.

Nuclei vulnerability templates

ProjectDiscovery’s nuclei runs its CVE, exposure, default-login and misconfiguration templates against the target, with injection templates added on a full scan.

WordPress-specific

If WordPress is detected, WPScan kicks in: core, plugin and theme versions, user enumeration and exposed wp-config.php backups.

OWASP web app scan

OWASP ZAP active scan (full tier) probes for XSS, SQL injection, CSRF, open redirects, path traversal, the OWASP Top 10 staples. Only run it against sites you are allowed to test.

AI summary of findings

Claude writes a plain-English summary of the scan, the top actions to take and grouped fixes. Hand the report to a developer or a client without translation.

03 · Scan depths

Two scan depths

Quick baseline for routine checks; deeper active scan when you need a real audit.

Baseline · ~10 minutes

Passive & light-active scan

Port fingerprinting, TLS audit, security headers, tech fingerprinting, nuclei templates and WPScan (if WordPress is detected). Light enough to run against your own sites routinely.
  • Included on Starter, Pro and Agency
  • Re-run any time, results stored against the domain
  • Roughly 10 minutes from click to report

Full · an hour or more

Active OWASP web app scan

Everything in baseline, plus subdomain discovery and OWASP ZAP active scanning: XSS, SQLi, CSRF, open redirects, the OWASP Top 10 in depth. This is the scan you run before a launch or a board review, not on every domain every week.
  • Active scanning is intrusive: only run it on sites you own or have permission to test
  • Recommended once per quarter per site
  • Suggested IP allowlisting for sites behind strict WAFs

Security scans spend monitoring credits from your monthly pool, 2 credits for a baseline scan, 8 for a full deep scan, out of 250, 1,250 or 5,000 credits a month on Starter, Pro and Agency. Need more? Extra credit packs are available (100 for $32, 300 for $75, 750 for $150), and purchased credits never expire.

04 · Pricing

Simple, transparent pricing

Every paid plan starts with a 7-day free trial. Cancel during the trial and you won't be charged.

Free forever

Free

Monitor one site, free forever

$0/mo

1 website + 4 extra monitors

No credit card needed

  • Uptime checks every 5 minutes
  • Response time tracking
  • Domain expiry alerts
  • SSL certificate expiry alerts
  • Email alerts
Start free

7 days free

Starter

For individuals & small portfolios

$11/mo

Up to 5 websites

250 monitoring credits / month

  • Uptime, SSL, DNS & blacklist
  • Content & visual change monitoring
  • Accessibility (WCAG 2.2) monitoring
  • Email health & renewal alerts
  • PageSpeed & malware scanning
  • Free WordPress plugin
  • WHM & cPanel monitoring
  • Bulk import & export
  • Security, SEO & compliance scans
  • AI integration (Claude & ChatGPT)
Start free trial

Most popular

Pro

For active managers & agencies

$29/mo

Up to 25 websites

1,250 monitoring credits / month

  • Everything in Starter
  • Up to 5 team members
  • Client report builder
  • AI search visibility
  • Priority support
  • Security, SEO & compliance scans
  • AI integration (Claude & ChatGPT)
Start free trial

7 days free

Agency

For large portfolios & teams

$89/mo

Up to 100 websites

5,000 monitoring credits / month

  • Everything in Pro
  • Up to 20 team members
  • Agency CRM & white-label reports
  • Security, SEO & compliance scans
  • Dedicated support
  • AI integration (Claude & ChatGPT)
Start free trial

Bigger than 100 websites? Our Enterprise plan adds unlimited sites, custom data residency, an SLA, dedicated onboarding and custom integrations. Talk to us

*SMS alerts are an optional add-on on paid plans for UK mobile numbers, paid for with prepaid SMS credit packs. Prices exclude any applicable sales tax. Your card won't be charged during a paid-plan trial. Cancel anytime.

05 · Questions

Frequently asked questions

Is this a real penetration test?

No. A pentest is a manual engagement by a human consultant chaining findings together. TLDTrack’s scans run the same tooling a pentester would start with (nuclei, nmap, ZAP, WPScan, testssl.sh) and catch the same categories of issue, automated, repeatable, and far cheaper. For high-risk sites you should still book a manual pentest annually; we’ll catch the rest in between.

Do I need permission to scan?

You should only scan domains you own or have explicit written permission to test. The baseline scan is light and suits routine use on your own sites; the full ZAP scan is genuinely active (sends real attack payloads) and can trip WAFs. Scanning a site outside your portfolio asks you to confirm you own it or have permission.

Will this trigger Cloudflare or other WAFs?

The baseline scan is gentle and usually flies under the radar. The full ZAP scan is intentionally aggressive, set the origin server IP on the domain so the scan bypasses the WAF if you want clean results.

How long does a scan take?

Baseline scans take about 10 minutes on a typical small/medium site. Full scans usually take an hour or more. Each tool in the scan has its own time limit.

Where does the scan run from?

Each scan runs in an isolated AWS Fargate container in London (eu-west-2). Findings are stored in the UK. Scans currently run from AWS addresses that change between runs, so if your site is behind a WAF set the origin server IP in TLDTrack and the scan bypasses it.

Are findings stored?

Yes, each scan’s raw output and AI-rewritten findings are stored against the domain so you can compare runs and track whether issues have been resolved.

Is there a free trial?

Yes. Every paid plan includes a 7-day free trial, your card is not charged for 7 days. Run a real scan and see the report before you commit.
Mark Grice, founder of TLDTrack

Mark Grice, founder of TLDTrack. Runs FullyCoded, a Cornwall web agency, and built this to keep 500+ client sites in front of him every day.

What happens next

Stop hoping the staging box is locked down

Do it yourself

Start your free trial

One click. Full scan. Plain-English report. Run it against every domain you manage, every quarter, without a security consultant on retainer.

Start your free trial

Talk it through

Arrange a call with Mark

If you would rather talk through how this works across every site you look after, we can go through it together.

Book a call

06 · Explore

Explore more of TLDTrack

All features overviewEvery check TLDTrack runs and what it costs.For agenciesManage every client domain in one dashboard.TLDTrack vs UptimeRobotHonest feature-by-feature comparison.Free email deliverabilityFree SPF / DKIM / DMARC checker, report by email.iOS & Android appsPush alerts when something breaks.