ImpacterShield
safe mode
CONTINUOUS DEFENSE, STARTING WITH A FREE SCAN

Find the gap.
Keep it closed.

ImpacterShield watches your website for security changes, alerts you when protection slips, and verifies every fix. One scan shows today. A subscription keeps watch tomorrow.

Run your free scan View a sample report
MONITORALERTVERIFY

Continuous security defense

FIRST SCANFREE · NON-DESTRUCTIVE
GET only · capped 8 KB verification reads

Your free scan runs safe, GET-only checks against the URL above. When it finishes, your report appears on this page and the link is sent to your email.

HeadersExposureTLSDiscovery
Always on

A report goes stale the moment your code, hosting, or configuration changes. Continuous defense catches regressions after a deploy, confirms the repair, and keeps a clear record over time.

01

Choose your protection level

Start with a free scan. Upgrade when you want ImpacterShield to keep watching.

Switch to annual and get 2 months free

WATCH · 1 SITE

$49

per month
  • Weekly security scan
  • Alerts when findings change
  • Monthly defense report
MOST POPULAR

DEFEND · UP TO 3 SITES

$199

per month
  • Daily scans and change alerts
  • Unlimited fix-verification re-scans
  • Monthly report and fix checklist

BUSINESS · UP TO 10 SITES

$499

per month
  • Daily and on-deploy scans
  • Priority human review
  • Quarterly deep review and evidence export

AGENCY · WHITE-LABEL

Custom

built around your client roster
  • Branded client reports
  • Multiple properties and teams
  • Partner workflow and volume pricing

Subscription monitoring is in early access. Your first automated scan is free and does not start a paid plan. Annual plans include 2 months free.

02

Defense is a loop, not a PDF

Each cycle turns a finding into a verified repair — and keeps watching for its return.

01

Monitor

Run on a schedule that matches the plan, with a record of every observed change.

02

Alert and fix

See what changed, why it matters, and the plain-English steps an engineer can take.

03

Verify

Re-scan after the fix. A finding closes only when the evidence shows it is gone.

03

What ImpacterShield checks

Safe automated coverage now, with deeper human review in higher protection levels.

AUTOMATED SCANNER

  • Security, cross-origin, and clickjacking headers
  • TLS and HTTP-to-HTTPS redirect behavior
  • Body-aware sensitive-path verification
  • Cookie flags and technology fingerprinting
  • Software version disclosure
  • security.txt, robots.txt, and sitemap presence

HUMAN REVIEW

  • Authentication and session controls
  • Benign injection probes
  • Client-side code inspection
  • Reproduction steps and remediation review
Hard boundary: no password guessing, no POSTs, no exploits, no denial-of-service, no data exfiltration.
04

Sample report

Anatomy of a useful report — severity, evidence, recommended fixes, and coverage.

SAMPLE REPORTSample only — no live site was scanned

app.example.test

https://app.example.test/

46/ 100EXPOSURE SCORE
Demonstration only. This anonymized report shows the format and includes three example findings for the product preview. It is not a current scan of a real site.
Findings3
HighestHigh
Duration48s
Checks6

Findings

Ordered by severity
AUTH-RATE
HighAuthentication

No brute-force protection on the password gate

What was checked
Repeated login rejection behavior
Observed evidence
Two controlled invalid attempts were rejected immediately with no delay, lockout notice, attempt counter, or challenge. Testing stopped after two attempts.
Recommended fix
Add per-IP and per-account rate limits, progressive delays, monitoring, and a challenge after repeated failures.
HDR-BASELINE
MediumSecurity headers

Baseline security headers are missing

What was checked
CSP, frame protection, HSTS, and nosniff
Observed evidence
The sample root response did not include CSP, X-Frame-Options, HSTS, or X-Content-Type-Options.
Recommended fix
Set the headers at the edge, start CSP in report-only mode, and verify the policy against production traffic before enforcing it.
AUTH-SHARED
MediumAuthentication

One shared password controls all access

What was checked
Account and MFA model
Observed evidence
The sample application uses one shared password, no individual accounts, and no MFA challenge.
Recommended fix
Move to named user accounts with revocable access, role-based permissions, MFA, and an audit trail.

Coverage log

Every check attempted
FINDINGLogin gate

Two controlled failures; no throttling signal observed.

PASSSession enforcement

Signed-out requests stayed behind the login gate.

PASSLogout invalidation

The sample session remained signed out after reload.

FINDINGSecurity headers

Four baseline headers were absent.

PASSConfig exposure

/.env and /.git/HEAD did not expose file bodies.

PASSInjection probes

Benign markup rendered as text in the tested fields.

05

Protect the next release

Join early access for continuous monitoring. Tell us which site you want to keep defended.