Weekly or daily re-scans · Plain-English alerts · No IT team required

Find security issues on your website before they become problems.

Urlet scans your domain on a schedule — weekly on Starter, daily on Pro and Enterprise — and emails you when something changes: expired certificate, data breach, misconfigured DNS, exposed file, open port. Plain answers in your inbox, no dashboard-watching.

Create free account & scan See what we check

The free scan needs a free account. Sign up in under a minute, no credit card, and you go straight to your scan. Already registered? Log in.

Detects threats like: SSL expired Domain spoofing via SPF Credentials in data breach Open admin ports Exposed .env files

How it works

1
Create a free account

Sign up free, no credit card, and enter your domain. Your first scan runs right away, so you know where you stand today.

2
We re-scan on a schedule

Paid plans re-scan automatically: weekly on Starter, daily on Pro and Enterprise. 32 checks every run, not one-off snapshots. The free scan is a single run.

3
Get plain-English alerts

When something changes, you get an email written for a business owner, not a security engineer: what happened, why it matters, what to do.

SAMPLE REPORT · made-up domain

This is what you get after a scan

Every finding includes a plain-English explanation and a concrete next step.

example-business.com
Scanned Oct 25, 2026 · sample report
● 3 critical ● 4 warnings ● 11 passed
Critical
DMARC record missing
Anyone can send email pretending to be @example-business.com. This is how phishing and invoice fraud start — customers get a convincing email that appears to come from you.
→ Add a DMARC TXT record to your DNS: v=DMARC1; p=quarantine; rua=mailto:dmarc@example-business.com
Port 8080 open and accessible
An admin or development service is reachable from the internet on port 8080. Attackers actively scan for these — if it's a control panel or API without auth, you could be compromised.
→ Close port 8080 in your firewall or restrict access to known IP addresses only.
.env file publicly accessible
Your .env file is returning a 200 response at https://example-business.com/.env — this file typically contains database passwords, API keys, and other credentials in plain text.
→ Block access to .env files in your web server config immediately and rotate any exposed credentials.
Warnings
SSL certificate expiring in 14 days
Your certificate expires Nov 8, 2026. Visitors will see a browser warning and some connections will be blocked if it lapses.
→ Renew via your hosting provider or set up auto-renewal with Let's Encrypt.
SPF record uses ~all (soft fail)
Your SPF record ends with ~all, meaning spoofed emails are marked as suspicious but not rejected. Changing to -all (hard fail) prevents most spoofing attempts outright.
→ Update your SPF record to end with -all once you've confirmed all your sending sources are listed.
Server version disclosed in response headers
Your server is broadcasting "Apache/2.4.51" in the Server header. Attackers use this to target known vulnerabilities in that exact version.
→ Set ServerTokens Prod in your Apache config to hide the version string.
Content Security Policy header missing
No CSP header detected. Without it, browsers won't block injected scripts if your site is ever compromised — making any XSS vulnerability significantly worse.
→ Add a Content-Security-Policy header. Start with a report-only policy to understand your script sources.
Passed — 11 checks
Domain expiry — 347 days remaining
Not on Google Safe Browsing list
No data breaches found
Not on any spam blacklists
HTTP → HTTPS redirect working
HSTS header present
DKIM record configured
Cookie security flags set
Site uptime: 100% last 30 days
CAA records protecting cert issuance
robots.txt — no sensitive paths exposed
Every finding includes a plain-English explanation and a concrete next step. Create free account & scan →

32 checks on every scan

Everything is checked from outside: nothing to install, no access to your server needed.

Certificates & encryption

SSL certificate expiry & validity
CAA records — restrict who can issue your SSL cert
Outdated TLS versions still accepted TLS 1.0 · 1.1 · after you verify ownership
HSTS policy & preload readiness
Certificate chain completeness
Certificate Transparency — unexpected certificates

Domain & DNS

Domain expiry — avoid losing your domain
DNS records health
DNSSEC — protection against forged DNS answers
Wildcard DNS records
Look-alike domains registered by others
Subdomain takeover — dangling CNAMEs · after you verify ownership

Email

Company email in data breaches
Spam blacklist reputation
Email impersonation protection SPF · DMARC · DKIM
Brand logo in inboxes BIMI

Website hardening

Browser security headers CSP · HSTS · X-Frame
Cookie security flags — protect user sessions
HTTP → HTTPS redirect — plain-text traffic detection
CORS policy — which sites may read your responses
HTTP TRACE method enabled · after you verify ownership
Path traversal — reading files outside the web folder · after you verify ownership

Exposure

Exposed admin ports and services · after you verify ownership
Web ports 80 and 443 reachable default ports only
Outdated PHP with known vulnerabilities
Sensitive files exposed publicly .env · .git · backups · after you verify ownership
Server & CMS version disclosure — stops fingerprinting
robots.txt — sensitive paths advertised to crawlers
AI crawler access to your content · after you verify ownership
Open directory listings · after you verify ownership

Reputation & availability

Google Safe Browsing blacklist
Site uptime & reachability
Create free account & scan

Free account required, no credit card.

EXAMPLES · NVD data, refreshed daily

Vulnerabilities we look for

A sample of recently published vulnerabilities in common web software. These are general examples from the public NVD database, not results for your domain. Your scan reports only what it finds on yours.

New vulnerabilities published per year (NVD)
* Current year, counted so far.
Example data loading, check back shortly.

Simple pricing

Built for small businesses. Less than the cost of a single incident.

Free
$0
One-off scan, free account required
  • ✓ Single on-demand scan
  • ✓ AI plain-English report
  • — No monitoring
  • — No PDF export
  • — No alerts
Create free account
Starter
$29/mo
1 domain
  • ✓ Weekly monitoring
  • ✓ Email alerts on change
  • ✓ AI plain-English report
  • ✓ PDF report export
  • ✓ Scan history (last 10)
Get started
Pro
$59/mo
5 domains
  • ✓ Daily monitoring
  • ✓ Full port scan details
  • ✓ Webhook alerts (Slack / Teams)
  • ✓ PDF report export
  • ✓ Scan history (90 days)
Get started
Enterprise
Custom
Unlimited domains
  • ✓ Daily monitoring
  • ✓ Webhook alerts
  • ✓ PDF report export
  • ✓ Scan history (unlimited)
  • ✓ Compliance exports (SOC2 / ISO27001)
  • ✓ Dedicated support
Contact us

Starter re-scans weekly; Pro and Enterprise re-scan daily. Alerts are emailed when a re-scan finds a change.

Start with a free scan

Create a free account (no credit card) and see your domain's security posture in under 2 minutes.

Create free account & scan