Most people who own something on the internet are not security specialists. They run a shop, a practice, an agency, a small SaaS. They have a website, a mail domain and a couple of servers — and no realistic way to answer a simple question: is any of this configured badly enough to hurt me?
The usual answers are bad. Hire a consultant, and you get an excellent report once a year for money that does not fit a small budget. Run a free scanner, and you get a wall of CVSS scores, protocol names and severity codes that tell you something is wrong without telling you what to do about it. Do nothing, and you find out the hard way — an expired certificate on a Saturday, a customer forwarding you a phishing email that came convincingly from your own domain.
ClickScan is our answer to that gap, and it is launching soon.
It runs the same checks our penetration testers run by hand, on a schedule you choose, and writes the result the way a colleague would explain it: what you have, how serious it is, and exactly what to do about it. No jargon to decode before you can act, no consultant to book, no contract to sign.
This is what a finding looks like. A severity, one sentence of plain English, and the fix — not a CVSS vector to decode.
Not live yet — but here is exactly what is coming
ClickScan is in final testing. Nothing on this page is available to the public today, and we would rather tell you that plainly than let you discover it after signing up. What follows is what the platform does, in the order we are shipping it.
The checks
SSL/TLS certificate and encryption. Is your HTTPS valid, trusted and modern? Certificate expiry and trust chain, every protocol version and cipher suite your server actually accepts, forward secrecy, HSTS, OCSP stapling, certificate transparency and CAA — graded from A+ down to F. Named weaknesses are actively probed, not guessed: Heartbleed, POODLE, ROBOT, DROWN, Logjam, CRIME, Ticketbleed, CCS injection, insecure renegotiation and the CBC padding-oracle family. If we cannot complete a test, the report says "not tested" rather than quietly passing you.
HTTP security headers. Whether your site sends the response headers that protect your visitors — HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy — plus the cross-origin isolation headers, anything deprecated, and the headers that quietly advertise which software and version you are running.
Email security (SPF, DKIM, DMARC). Can scammers send email as you? We check your mail servers and your full email authentication set: MX, SPF, DKIM, DMARC, MTA-STS, TLS-RPT and BIMI. The report carries the raw DNS answers we read, plus a generator that writes out the exact records to paste into your DNS panel — already filled in with your domain, because the most common way this goes wrong is a record published with example.com still in it.
Email spoofing test. We actually try to deliver a forged message to your own domain and show you whether it got through. Proof, not theory. It is one fixed, plain-text message that explains itself, and it can only ever be sent to an address at the domain being tested. If your mail server refuses it for the wrong reason — a mailbox that does not exist, say — we report the test as inconclusive instead of calling it a pass, because a false all-clear is worse than no test.
Email breach exposure. Which known breaches one of your addresses appears in, and what types of data each one held — passwords, addresses, phone numbers. A mailbox is an asset in its own right here, so it gets the same history, scheduling and reports as a domain. We never receive the breached values themselves, and there is nowhere in our system to put them.
Then, in this order: domain threat intelligence (look-alike and typosquatting domains registered to impersonate your brand), open ports and perimeter, subdomain and asset discovery (the hosts attached to your domain that you had forgotten about), infrastructure vulnerability scanning (CVEs and misconfiguration), and web application scanning (DAST). We are adding checks continuously — if you need something specific, tell us.
Around the checks: the platform
A scanner on its own is a tool. What makes it usable by a non-specialist is everything around it.
Everything you watch in one list — with the grade it currently holds and when it was last checked. Screens are from a demo account.
- Assets you actually own. Keep an inventory of the domains, IP addresses and mailboxes you watch, imported and exported as CSV. For the deeper checks we ask you to prove an asset is yours, in whichever way suits it: a DNS TXT record, a file at
/.well-known/, a code emailed to an address at the domain, a callback from the IP itself, or reverse DNS. - On demand, booked, or recurring. Run a check now, book it for a date and time in your own time zone, or repeat it daily, weekly or monthly. Recurring runs are discounted, so continuous monitoring stays cheap — and if a scheduled run cannot be paid for, we tell you and leave the schedule active.
- Your whole estate in one go. Select many assets and many checks at once; the wizard asks only for what each one needs, skips combinations that do not apply, and shows the total cost before you spend a credit.
- Reports people actually read. An A+ to F grade, a line naming the finding that drove that grade, and findings written as "what you have / how bad it is / what to do" — each marked with how we know it, whether we proved it or read it from a published record. Underneath sit the cipher tables, raw DNS answers and per-weakness verdicts for whoever wants the evidence. Export one scan as a PDF, or one report covering every check on an asset, as an executive summary or in full.
- What changed since last time. Each scan is compared with the previous one for the same asset and check, and you only hear from us when something actually moved — leading with what got worse and naming it, rather than an identical email every morning.
- "We know, that one is fine." Mark a finding as not applicable on one asset, with a reason on the record. It always expires, it never changes the grade, and it is hidden rather than deleted — so the report you hand a client is still the truth.
- Your brand on the report. Agencies and consultants can put their own logo and colour on the PDFs.
- Alerts that arrive before the problem. You are told before a TLS certificate expires — at 30, 7 and 1 day, and again if it lapses — when a scan finishes or fails, and when something changed. In the app and by email.
- One view of your exposure. A dashboard answering the questions worth asking: which assets are worst, how many open findings and how serious, how much of what you own has actually been checked, and whether your grades are improving.
What it costs
Pay as you go. You buy credits and spend them on the scans you actually run — no subscription, no per-seat fee, no lock-in. New accounts get free starter credits, recurring runs are discounted, and referrals earn credits for both sides.
Two things we think are only fair: a scan that fails is refunded automatically, and a check that had nothing to test — a spoofing test against a domain that receives no email, say — is graded "not applicable" and refunded rather than sold to you as a good result. Credits you pay for do not expire; free ones last twelve months from the day they are granted and are always spent first.
Who it is for
- Freelancers and solo makers — check your own sites and your clients' without hiring a pentester, and look more professional doing it.
- Startups — ship fast without leaving security behind, on a startup budget and with no security hire.
- SMEs and IT teams — keep an eye on your domains, certificates and email without a dedicated security team, with reports you can put in front of management.
- Agencies and MSPs — monitor every client from one place using separate groups, and hand each one a clear, branded report they understand.
- Enterprise and security teams — lightweight, continuous external monitoring alongside your existing stack.
- Bug bounty hunters and researchers — fast recon on authorized targets, graded and exportable.
What you are allowed to scan
The passive checks — TLS, headers, email records — read public data. For active checks you confirm you are authorized to test the target, and for the deepest ones we also ask you to prove the asset is yours. There are light limits by default (two concurrent scans against the same host, 200 queued per account) to keep our scanning gentle on the systems you point us at. If you run infrastructure and would rather we never touched it, write to [email protected] and we will block it platform-wide.
Be first in
ClickScan is coming soon. If you would like to be among the first accounts in when it opens, ask us for early access — we will tell you the day you can add your first asset.
ClickScan is built by ClickSecure AI, whose team has spent 15+ years doing this work by hand. When automation is not enough, the same people run the manual penetration test.