Is your website vulnerable?
Find out in 60 seconds.
CLIC404 checks your website the way an attacker would —certificates, headers, exposed files, spoofable email— and tells you how to fix each issue. Then it keeps watching on its own and emails you.
Check your SSL certificate instantly
Free and no signup: type your domain and see in seconds whether the certificate is valid, who issued it and when it expires.
What does "protected" mean?
That the site has a valid, current certificate: the connection is encrypted and the browser trusts who issued it.
Does this install SSL on my site?
No. It only checks the public certificate already installed. If something is wrong, installation or renewal is done by your host or admin.
Why does my certificate not appear?
If the domain does not resolve, has no HTTPS on port 443 or the certificate belongs to another site, the check marks it as no SSL or invalid. If you think it is a mistake, try the full analysis.
What an attacker looks at first
Every attack starts with reconnaissance: what software you run, what you left exposed, whether your email can be spoofed. We look at the same things from the outside, without attacking, so you can close them first.
HTTPS and certificate
Encryption, secure redirect, certificate expiry and HSTS.
Security headers
CSP and its quality, Permissions-Policy, clickjacking protection, HSTS, MIME sniffing and URL leaks.
Exposed files
.env, .git repositories, backups and phpinfo, confirmed by their content.
Spoofable email
SPF, DKIM and DMARC: whether someone can send email in your name.
Visible software
Server, PHP and CMS versions in plain sight: the first thing a bot looks for.
DNS
CAA (who can issue your certificates) and DNSSEC.
Session cookies
Secure, HttpOnly and SameSite, so sessions cannot be stolen or cookies reused from another site.
Uptime
On paid plans: downtime checks every 5 minutes and SSL expiry alerts.
We look at all of this from the outside and without attacking: we do not exploit flaws, submit forms or probe rate limits. If nothing shows up, we say “no findings on the passive surface evaluated”, not “secure site”.
Detect, fix and monitor. All automatic.
Scan
Enter your domain and within minutes the report arrives by email, with a score and a risk level.
Fix
Each finding explains why it matters and gives the exact code or setting to fix it.
Monitor
CLIC404 repeats the checks every 24, 12 or 1 hour depending on your plan and alerts you as soon as something new appears.
We speak your auditor's language
Each finding maps to the attack technique it enables and to the matching security control. And we measure what matters: how fast we detect and how fast you fix.
The references are guidance: they do not imply ISO certification.
What we do not do (and we say so)
- We do not install agents on your devices: we are not an EDR/XDR.
- We do not read your logs: we are not a SIEM or a SOC.
- It is not a penetration test: we look at what is public, without exploiting anything.
- We do not submit forms or probe rate limits: warnings about forms without a token are hints, not confirmations.
Continuous monitoring for your website or company
Start with the scan and, if you want us to keep watching, pick a plan. Prices in US dollars, cancel anytime.
- 1 verified site
- Security check every 24 h
- Email alerts for new findings
- Downtime every 5 min and SSL expiry
- History and PDF reports
- Up to 3 verified sites
- Security check every 12 h
- Alerts, history and PDF reports
- Resolution metrics (MTTR)
- API to integrate the scanner
- Up to 10 verified sites
- Hourly security check
- Monthly executive report (MITRE ATT&CK + ISO 27001)
- MTTD and MTTR per site
- API and priority support
Automate your business in your own n8n
Ready-made workflows to download and install on your server: you connect your accounts and they keep running. One-time payment, guide included.
What people ask us
Is it legal to scan a site like this?
Yes: we only look at what anyone can see from the internet, without logging in or exploiting anything. For safety, the full detail and the fixes are only shown to whoever proves they own the site.
Do I need to install anything?
No. Everything is external. For monitoring you only verify that the domain is yours with a tag or a file.
What happens if you find a problem?
You get it by email with the explanation and the exact fix. Once you fix it, the next check marks it as resolved and it stays in your history.
What are MITRE ATT&CK and ISO 27001?
MITRE ATT&CK is the public catalog of techniques attackers use; ISO/IEC 27001 is the information security management standard. We use them as a reference so your team or your auditor understands each finding.
Can I cancel anytime?
Yes, from your dashboard. No lock-in.
See your site the way an attacker does
One domain, one email, and within minutes you have the report.
Scan my website