Auditly
Verify your domain

Prove it's your domain. Then we scan it.

A DNS record or a file at your root proves it's yours. Then Auditly runs the same active checks as the desktop product — straight from your browser.

We only scan domains verified by their own owner.

See a sample report

What a scan looks like

The scan runs every check live against your site. The report tells you what to fix first.

auditly scan example.com

  1. [ok] domain verified DNS TXT auditly-verify=3f9a…
  2. [..] crawl same-origin, 23 pages, 4 forms
  3. [..] tls cert valid, 214 days left · HTTP→HTTPS 301
  4. [!!] headers no Content-Security-Policy
  5. [!!] headers no X-Frame-Options / frame-ancestors
  6. [!!] headers no Referrer-Policy
  7. [!!] server Server: nginx/1.18.0
  8. [!!] cors Access-Control-Allow-Origin: *
  9. [!!] cookies sid set without HttpOnly
  10. [..] files .env, .git, backups: none exposed
  11. [..] secrets 11 JS bundles, 0 keys
  12. [..] firebase rules deny anonymous reads (3 collections)
  13. [..] injection XSS / SQLi probes on 9 GET params
  14. [ok] report ready 6 fixes, none critical · PDF sent

15 checks212 requests1m 48s

example
AUDITLY SECURITY AUDIT REPORT

REPORT ID

AUD-20260910-4f2a91

TARGET

example.com

ISSUED

Sep 10, 2026

No critical or high-severity issues found6 lower-severity findings — see recommended fixes below

Recommended fixes

MEDIUM

Replace Access-Control-Allow-Origin: * with an allowlist

A wildcard lets any site's JavaScript read this response — fine for public data, risky if anything is user-specific.

MEDIUM

Add a Content-Security-Policy header

No CSP set — an injected script would run with full page privileges.

MEDIUM

Add clickjacking protection

The page can be framed on another site and tricked into fake clicks.

+3 more fixes in the full report

How it works

Three steps, in this order: no scan gets queued until the first two are confirmed.

  1. DNS / file

    Verify your domain

    Add a DNS TXT record or upload a file to your site's root. We confirm you control the infrastructure before touching it.

    auditly-verify=3f9a1c07e2b4d815
  2. Stripe

    Pay for the scan

    Payment is verified first. The job only gets queued once the gateway confirms it, never before.

    $29 CAD · one-time
  3. PDF

    Get your report

    A summary lands in your inbox and the full PDF report follows, usually within minutes.

    auditly-example.com.pdf

Why we ask you to verify the domain

Auditly runs active tests — it attempts injections, checks login rate limits, and looks for secrets in client-side code. That's sensitive to touch, so we confirm first that whoever requests the scan controls the domain.

ADNS TXT record

Add this value as a TXT record on the domain you want scanned. You can remove it once verification is confirmed.

BFile at your site's root

No access to DNS? Upload a text file with the same value to your site's root.

We don't accept WHOIS as proof: since WHOIS privacy is the default at most registrars, the registrant's contact details are almost always hidden or redacted — it no longer reliably identifies who actually controls a domain. If neither method fits your case, write to us and we'll review it manually.

TypeHostValue
TXT@auditly-verify=3f9a1c07e2b4d815
    Verify your domain