Deep audit

A deeper, multi-page audit with a written fix plan

For when the free check is not enough: we run the full passive check-set across up to 25 pages of your site, group and prioritize every finding, and deliver a report with a step-by-step remediation plan. You can follow the progress live.

What it includes

  • Full passive checks on up to 25 pages per domain, not just the home page.
  • Every finding grouped by severity, with the exact configuration or code to fix it.
  • Email spoofing protection (SPF, DKIM, DMARC), TLS, headers, cookies, exposed files and visible software versions.
  • Executive summary plus a technical report with a prioritized remediation plan, and a re-test once you have fixed things.

US$500 · one-off payment · delivered in 5 business days · 2 audits per week

Prove that you own the site

Before we start we verify that you control the domain. Publish this value on your site:

a73c530b13fc411b

A DNS TXT record at _clic404-verify with that value, or a file clic404-verify-<value>.txt at the site root. We check it before the analysis; if it is not there, we scan nothing.

Scope, window and techniques (what you accept)
  • Only the domains you declare, with a maximum of 25 paths per domain and 20 requests per minute.
  • A 72-hour window starting when we pick up the order. Outside that window nothing is run.
  • Not allowed: denial of service, brute force, social engineering, vulnerability exploitation, access to third-party data, exfiltration, persistence, directory fuzzing and hunting for leaked credentials.
  • The report is confidential: only you and whoever you designate receive it, and it is not published without your written authorization.

Rules hash: 724488106831b4ba

What will be scanned

  • Audited domain: the one you type above
  • Up to 25 paths, 20 requests per minute and GET/HEAD only; forms are never submitted and no data is changed.
  • Passive, automated checks only: no exploitation, no brute force and no fuzzing. This is not a penetration test.
  • 72 h window starting when we pick up the order; report within 5 business days.

All fields are required except the context. Use an email from the domain you are auditing.

The email must belong to that domain (or one of its subdomains). The report goes to this address and all messages come from security@clic404.com.

One-off payment with PayPal. If you do not agree with the scope, you pay nothing.