Vanhorn SI

WEAKNESS SCAN

What your site shows the public · Vanhorn SI

← Back to vanhornsi.com

ENGLEWOOD, FL · LOCAL HARDWARE · SYSTEMS YOU OWN

01 / WHAT IT IS

A read on what you are showing the public

Every site volunteers more than its owner thinks. This is a scoped look at what yours hands to anyone who asks, ranked by what to fix first.

No build required

You do not have to hire us to fix anything. The report is yours either way.

Plain English

What we saw, why it matters, and the specific thing to change. No CVE soup.

Ranked

High, medium, low. The high items are reachable by anyone right now.

02 / WHAT IS CHECKED

Public surfaces only

Everything below comes from what your server returns to an ordinary request.

Transport

HTTPS, whether the insecure address still serves the site, and how long HSTS lasts.

Security headers

CSP, HSTS, clickjacking protection, referrer and permissions policy, content-type handling.

Version disclosure

Whether your server announces exactly which software and version it runs.

Files that should not be public

Config, environment and backup files, and exposed source control. We record that a file answered. We do not read it.

Open directory listings

Folders that list every file inside them to anyone who visits.

Cookie flags

Whether cookies are restricted to secure connections and kept away from scripts.

03 / SCOPE

Where the line is

What we doLook at what your site publishes to the public internet, and write down what should not be published. Observation and reporting.
What we do not doNothing is exploited. No payload is sent, no input is tested, no credential is guessed, no login is touched. If a file is reachable, the finding is that it is reachable — we do not open it and we do not quote from it.
Authorization firstWe scan a domain when its owner asks us to, and the request records who authorized it. We do not scan uninvited, and we will not scan a domain on someone else's behalf without the owner's say-so.
This is a starter scanIt is not a penetration test. It does not test your application logic, your access control, your staff, or anything behind a login. If you need that, it is a separate job with a proper scope and a contract. We will say so rather than sell you this instead.

04 / PROCESS

How it runs

  1. Authorize. You confirm the domain is yours, or that the owner asked for this.
  2. Scan. A bounded pass over public surfaces, rate-limited, robots.txt respected.
  3. Verify. Every high finding is reproduced by hand. A scanner cannot tell a deliberate choice from a mistake.
  4. Report. Ranked findings with the specific fix for each. Yours to keep or hand to whoever maintains the site.

Draft pricing stays “ask us” until we have seen the size of the surface.

05 / START

Request a weakness scan

One form. You confirm the domain is yours on the way through.

Request a weakness scan Or email us