Run a full security scan on any domain in your portfolio in one click. Subdomain discovery, open-port scanning, TLS audits, OWASP web vulnerability checks, WordPress-specific scans, and AI-summarised findings, all from your dashboard.
7-day free trial · cancel anytime
If you manage more than a handful of domains, you can’t manually pentest each one every month. TLDTrack runs the heavy tooling for you, then summarises the findings in plain English.
See your real attack surface
Forgotten staging subdomain still exposed? Old Tomcat manager still on port 8080? We find the things you forgot were there, before someone else does.
CVE coverage on autopilot
Scans run against a continuously updated library of 13,000+ known CVE and misconfiguration templates. New vulns get checked the next time you scan, no rule-writing required.
Plain-English findings
Raw nmap, ZAP and nuclei output is fine for security engineers, but useless to most clients. Every finding is rewritten with what it means, why it matters and how to fix it, so you can hand the report to a non-technical stakeholder.
Track posture over time
Every scan is stored against the domain, so you can see whether last quarter’s findings have been fixed and whether new ones have appeared. Useful for audits, board reports and SOC2 evidence.
Each scan runs in an isolated Fargate container with industry-standard tooling. Nothing is shared between customers, nothing is cached.
Subdomain discovery
Passive enumeration via CT logs and threat-intel feeds (subfinder), plus live resolution checks (httpx). Find subdomains you forgot were there.
Port & service scan
Top-port nmap sweep to fingerprint what’s exposed: SSH versions, mail servers, admin panels, dev services accidentally left open to the internet.
TLS / SSL audit
Full testssl.sh pass: weak ciphers, deprecated protocols (SSLv3, TLS 1.0/1.1), known CVEs (Heartbleed, ROBOT, POODLE), certificate chain issues, HSTS posture.
Security headers
CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy. Graded with specific suggestions for missing or weak directives.
Tech fingerprinting
whatweb + httpx detection of CMS (WordPress, Drupal, Joomla), frameworks, web servers, WAFs. Drives the targeted checks that come next.
13k+ vulnerability templates
ProjectDiscovery’s nuclei runs the full template library against the target: known CVEs, default credentials, exposed config files, leaked secrets, misconfigured services.
WordPress-specific
If WordPress is detected, WPScan kicks in: plugin and theme vulnerabilities, user enumeration, exposed wp-config.php backups, weak admin endpoints.
OWASP web app scan
OWASP ZAP active scan (full tier) probes for XSS, SQL injection, CSRF, open redirects, path traversal, the OWASP Top 10 staples. Requires customer authorisation.
AI-rewritten findings
Every raw finding gets a plain-English summary, severity rating and a recommended fix written by Claude. Hand the report to a developer or a client without translation.
Quick baseline for routine checks; deeper active scan when you need a real audit.
Passive & light-active scan
Subdomain discovery, port fingerprinting, TLS audit, security headers, tech fingerprinting, nuclei templates and WPScan (if WordPress is detected). Safe to run against any site you own, no WAF or rate-limit warnings.
Active OWASP web app scan
Everything in baseline, plus OWASP ZAP active scanning: XSS, SQLi, CSRF, open redirects, the OWASP Top 10 in depth. This is the scan you run before a launch or a board review, not on every domain every week.
Every plan includes a 7-day free trial. No commitment required.
Try free for 7 days, cancel anytime, no charge
For individuals & small portfolios
£19/mo
Up to 50 domains
For active managers & agencies
£49/mo
Up to 250 domains
For agencies & resellers
£149/mo
Up to 1,000 domains
For large organisations
Custom
1,000+ domains
*SMS notifications are an optional paid add-on available on all plans. Standard SMS rates apply per message sent.
All prices are exclusive of VAT for business accounts.
Your card won't be charged during the trial. Cancel anytime. Book a demo
No. A pentest is a manual engagement by a human consultant chaining findings together. TLDTrack’s scans run the same tooling a pentester would start with (nuclei, nmap, ZAP, WPScan, testssl.sh) and catch the same categories of issue, automated, repeatable, and far cheaper. For high-risk sites you should still book a manual pentest annually; we’ll catch the rest in between.
You should only scan domains you own or have explicit written permission to test. The baseline scan is passive and very light-active and is safe against your own sites; the full ZAP scan is genuinely active (sends real attack payloads) and can trip WAFs. We require you to acknowledge ownership before running a scan.
The baseline scan is gentle and usually flies under the radar. The full ZAP scan is intentionally aggressive, send a heads-up to your WAF vendor or temporarily allowlist our egress IP if you want clean results.
Baseline: about 10 minutes. Full ZAP: 45-60 minutes on a typical small/medium site. Larger sites with more attack surface can run longer; we cap at 2 hours.
Each scan runs in an isolated AWS Fargate container in eu-west-2. Findings are stored in the EU. Egress comes from a fixed IP range so you can allowlist us if needed.
Yes, each scan’s raw output and AI-rewritten findings are stored against the domain so you can compare runs and track whether issues have been resolved.
Yes. Every plan includes a 7-day free trial, your card is not charged for 7 days. Run a real scan and see the report before you commit.
One click. Full scan. Plain-English report. Run it against every domain you manage, every quarter, without a security consultant on retainer.
All features overview
Every check TLDTrack runs and what it costs.
For small business
Plain-English website monitoring for non-technical owners.
For agencies
Manage every client domain in one dashboard.
TLDTrack vs UptimeRobot
Honest feature-by-feature comparison.
Free email deliverability
Free SPF / DKIM / DMARC checker, no signup.
iOS & Android apps
Push alerts the moment something breaks.
This action cannot be undone.