Security audit
Go deeper into security and internet exposure.
A paid security scan combines application analysis with internet-exposure intelligence. Findings are classified separately from observations. It is not a claim that every vulnerability will be found.
What the paid security scan covers
Hermes analyzes the application on the authorized host. Internet-exposure intelligence, powered by Shodan, adds publicly observed services, certificates, and related metadata. Siteory correlates the two sources and does not treat every open port as a vulnerability.
- Strict-Transport-Security once HTTPS is stable
- Content-Security-Policy, including weak unsafe-inline values
- X-Frame-Options or CSP frame-ancestors
- X-Content-Type-Options
- Referrer-Policy and Permissions-Policy
- Set-Cookie flags on authentication cookies when they appear
The security headers article explains how to prioritize those findings. Missing CSP on a login host is not the same as a missing Permissions-Policy on a brochure page.
What this audit is not
It will not find an IDOR. It will not fuzz your API. It will not replace a review from someone who can read the application code. It will catch the CDN configuration you forgot when you moved the site to a new edge.
That honesty is part of how Siteory handles security on our side as well. We scan only the URL you submit. We do not keep a public gallery of other people’s reports.
Where to put the header
The header has to appear on the HTML document the browser requested, not only on /favicon.ico or a static asset host. If you use Cloudflare or another CDN, set the fields at the edge or confirm the origin values survive the cache. Then re-scan. The security headers guide walks through HSTS timing and a first report-only CSP.
How it fits with SEO and AEO
Header work rarely moves rankings. It does move whether a security reviewer will approve the launch. Run it on the same host as the SEO audit and the AI search audit so the Markdown file describes one website.
After you ship a header, re-scan. CDNs strip fields more often than application servers do. The second report is the one that confirms the edge picked up the change.
Free audits find the obvious SEO and AI-visibility problems. Paid security scans are on pricing: $9 once, or $49 a month for ten.