~10 secTracking checker
Is every pixel firing?
Free tool · Security scan
Is your store leaking anything?
A passive scan of about 30 checks: HTTPS and HSTS, security headers, cookie flags, exposed files like .env and .git, admin pages and error pages that say too much. Nothing is changed or uploaded.
Free, no sign-upPassive checks onlyAbout 10 seconds
Only scan sites you own or have permission to test.
Also free:Tracking checkerROAS calculatorEmail deliverabilitySEO checkerWebsite speed test
Sample reportyourstore.com
- HTTPS redirect301Pass
- HSTSMissingFail
- Clickjacking guardMissingWarn
- Exposed filesNonePass
- Cookie flagsSecurePass
In short
How do I check my store for security problems?
Run the security scan on a site you own. It makes about 30 passive checks in some 10 seconds: HTTPS and HSTS, security headers, cookie flags, exposed files like .env and .git, admin pages and error pages that say too much. Nothing is changed or uploaded, and each result comes with the fix.
- You enter
- Your site
- Results in
- ~10 sec
- Price
- Free, no sign-up
- Highlights
- Headers, HTTPS and cookies · Exposed files like .env and .git · Nothing changed or uploaded
01 — What it checks
What an attacker looks at first.10
Automated attacks start by reading what any visitor can see. The scan reads the same things and tells you what to close.
Security headers
CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and cross-origin policies.
HTTPS
The redirect from HTTP, HSTS and its max-age, mixed content and insecure form actions.
Cookies
HttpOnly, Secure and SameSite on every cookie the page sets.
CORS & methods
Wildcard and reflected origins, and TRACE, PUT or DELETE on public pages.
Exposed files
.env, .git, backups, config files, phpinfo and other common leak paths.
Information leaks
Server versions, X-Powered-By, stack traces, emails in the HTML and generator tags.
Page source
Keys and passwords left in the code, and inline event handlers.
Forms
CSRF tokens on forms that post, and password autocomplete.
Links & redirects
target="_blank" without noopener, open redirects and meta refresh.
Policies
security.txt, robots.txt, admin pages and what your error pages reveal.
02 — How it works
Read only, start to finish.
We request your pages
The home page over HTTP and HTTPS, a missing page to see your error page, and a list of well-known paths.
We read what comes back
Headers, cookies, redirects and the HTML, compared against about 30 checks.
You get the fixes in order
Fails first, then warnings, each with the header or setting to change.
What a passive scan can’t see
Anything behind a login, your apps’ code, payment flows and how your team handles access. A security review covers those.
03 — Free scan or security review
The scan checks the doors. A review checks the keys.
What it reads
- Free scan
- Public pages and headers
- Security review
- Admin access, apps, staff accounts and code
Method
- Free scan
- Passive: read only
- Security review
- Hands-on review with your developer
Apps
- Free scan
- Not checked
- Security review
- Every app’s access to your store data
What you get
- Free scan
- Pass, warn or fail per check
- Security review
- A fix list ranked by risk
Time
- Free scan
- About 10 seconds
- Security review
- [5] working days
| What | Free scan | Security review |
|---|---|---|
| What it reads | Public pages and headers | Admin access, apps, staff accounts and code |
| Method | Passive: read only | Hands-on review with your developer |
| Apps | Not checked | Every app’s access to your store data |
| What you get | Pass, warn or fail per check | A fix list ranked by risk |
| Time | About 10 seconds | [5] working days |
Not sure you need an audit? Bring the free report to a call and we’ll tell you straight.
Book a strategy call
04 — More free tools
Check the rest of the store.
Each tool reads one thing and tells you the fix. Run them in any order.
- ~10 sec
InstantROAS calculator
What ROAS do you need?
~5 secEmail deliverability
Do your emails reach the inbox?
~5 secSEO checker
Can Google read your store?
~5 secWebsite speed test
How fast does your store answer?
FAQ
Questions about the scan.
Not on the list? Ask on a call, or by email.
Yes. It only reads: it requests your pages and a list of well-known paths, the way any visitor could. It never submits forms or tries passwords.
Shopify secures its platform and checkout. Your theme, apps and domain setup still add scripts, cookies and redirects; the scan checks what reaches shoppers.
Not necessarily. A missing header is a gap, not a breach. Fix the fails first; most headers take one setting in your host or CDN.
Only scan sites you own or have permission to test.
Info marks something worth knowing that isn’t a problem on its own, like your platform being visible. It doesn’t lower your score.
Still unsure?Saimul Islam reads every report people bring to a call.Doors closed?
Let’s grow.
Book a strategy call
Shoppers buy where they feel safe. Bring this report to a [30]-minute call.
Or write to [hello@domain.com]
