How it works
- Verify. Prove the site is yours. It takes a minute with a DNS record or a file, or nothing at all if Search Console already covers it.
- Check. From then on, every scan of the site also runs the security checks, on the same pages Accessibility and SEO & GEO already load.
- Fix. Findings are ranked by severity, each with how to fix it. Serious ones show on the Dashboard and Today, and can go to the Roadmap or to GitHub or GitLab issues.
- Recheck. Press Recheck after a fix, and the finding is marked fixed once it’s gone.
- Monitor. Once a day, Startica checks certificate logs, DNS and public vulnerability data for changes, and tells you what’s new.
Defensive only
Startica reads what any visitor’s browser receives: pages, response headers, cookies, certificates, public DNS records and a few well-known file paths. It never sends exploit payloads, fuzzes inputs, submits forms, tries passwords or crawls beyond your own pages, so it’s safe to run against production.
Honest about its reach
Outside checks see only the outside of a site. They don’t test how your application handles input, whether one user can see another’s data, or anything behind a sign-in. A short list of findings doesn’t mean a site is safe, and Startica never calls one secure, compliant, certified or pentested.
What it doesn’t do
- It doesn’t attack anything. No exploits, no fuzzing, no logins, no human or crowd testing.
- It doesn’t check sites you can’t prove are yours.
- It doesn’t change your site or DNS. Fixes are for you to make.
What it costs
The checks and monitoring are free. Monitoring uses free public services (certificate logs, OSV.dev, FIRST EPSS and CISA’s list of exploited vulnerabilities), which receive only your domain, library names and versions, and vulnerability ids. AI help is optional, on your own key. See Privacy.