Enter your URL below for a free, instant preview — no account needed to see your grade.
Point CyberScan at a URL and it does the rest remotely — nothing to install on your server.
Paste in your website or web app address from your dashboard.
CyberScan fetches your pages and checks them against dozens of malware, header and certificate signals.
Every finding comes with a plain-English explanation and the exact fix — sorted by severity.
Remote, non-destructive checks — CyberScan reads your site the way a browser or a search engine would, and never modifies anything. Every check exists because it affects a real business outcome, not just a technical score.
Content-Security-Policy, HSTS, and certificate validity/expiry. Why it matters: these are your browser's built-in defenses — missing them makes any other vulnerability far easier to exploit, and an expired certificate throws a scary warning at every visitor before they even see your site.
Whether Google Safe Browsing currently flags your domain. Why it matters: a flagged site shows visitors a full-page warning before they can reach you — often the single most damaging, and most fixable, issue a site can have.
Whether your domain can be forged in phishing email. Why it matters: without these records, anyone can send email that appears to come from you — putting your reputation and your customers at risk.
Detected WordPress core/plugins/themes checked against the WPScan Vulnerability Database. Why it matters: an unpatched, publicly known vulnerability is often the very first thing automated attack bots scan for.
Hidden iframes, obfuscated/packed JavaScript, defacement messages, and spam-link injection. Why it matters: a compromised site can silently infect visitors and get flagged by browsers overnight — catching this early is the difference between a quiet fix and a full-blown crisis.
What CMS, theme, and plugins are publicly detectable. Why it matters: most real-world breaches exploit outdated, unpatched software — knowing what you're running is the first step to keeping it current.
Cross-domain redirects that don't match your own configuration. Why it matters: unexpected redirects are a classic sign of compromise, and they silently break the trust between what someone searched for and where they land.
Title/description length, canonical tags, heading structure, alt text. Why it matters: these are the fundamentals search engines use to understand and rank your pages — get them wrong and a great site becomes invisible to the people searching for it.
Discovers every page via your sitemap and audits up to 100 of them. Why it matters: SEO problems compound across a site — a pattern repeated on 50 pages is worth fixing once, in your template, not 50 times.
Dead internal links found while crawling your site. Why it matters: every broken link is a dead end for a visitor and a small signal to search engines that a site isn't well maintained.
Duplicate titles and very thin pages. Why it matters: thin or duplicate content confuses search engines about what a page is actually for, directly limiting how well it can rank.
Mobile Lighthouse score, LCP, CLS, and Total Blocking Time. Why it matters: slow sites lose visitors before they see anything — page speed is both a direct Google ranking factor and one of the strongest predictors of who leaves before converting.
A/AAAA/MX/NS record presence and nameserver redundancy. Why it matters: DNS is the addressing system behind your entire online presence — a misconfiguration here can break your website and the email you send from the same domain.
Missing alt text, unlabeled form fields, skipped heading levels, non-descriptive link text, and unnamed buttons/links — the Web Content Accessibility Guidelines (WCAG) 2.2 Level AA criteria detectable from page markup alone. Why it matters: roughly 1 in 5 people have a disability that can affect how they use the web — inaccessible sites exclude real customers, and in several jurisdictions it's a legal requirement. This covers what's checkable remotely, not a full audit — criteria needing visual rendering (contrast, keyboard focus, target size) require a browser-based tool or manual review.
Viewport configuration and mobile-readiness indicators. Why it matters: more than half of web traffic is mobile — a site that isn't properly responsive frustrates most visitors before they ever become customers.
Federal and provincial authorities enforce legal standards covering user privacy, digital accessibility, marketing communications, and spam prevention for business websites operating in Canada. CyberScan flags this context alongside your technical findings so nothing falls through the cracks.
If a breach creates a real risk of significant harm to an individual, organizations must report it to the Office of the Privacy Commissioner of Canada, notify affected individuals as soon as feasible, and keep a record of every breach for 24 months.
Public-sector organizations of any size, and private/non-profit organizations with 50+ employees, must meet WCAG 2.0 Level AA on public-facing web content — a deadline that passed in 2021, with periodic compliance reporting still ongoing. CyberScan checks against WCAG 2.2 (the current W3C-recommended version), which is backward-compatible and satisfies this WCAG 2.0 AA requirement too.
Canada's Anti-Spam Legislation requires consent, clear sender identification, and a working unsubscribe mechanism for commercial electronic messages sent to a Canadian address.
Organizations must promptly notify Quebec's data protection authority (CAI) and affected individuals when an incident presents a risk of serious injury.
Alberta's private-sector privacy law sets its own real-risk-of-significant-harm notification duty, on a similar but separately enforced timeline.
Applies instead of PIPEDA for organizations operating solely within BC, with its own breach-related expectations.
This is general information, not legal advice, and CyberScan is not a substitute for a privacy lawyer, accessibility auditor, or a certified breach-response process. Applicability depends on your organization's size, sector, and province. Speak with a qualified professional to confirm what applies to you.
Every check, every report, no limits — no credit card, no upgrade tiers.