A free, read-only security check of your website.
We look at your site the way an outside attacker would: at most about 300 plain page requests, no logins, no exploit payloads, nothing written to your systems.
The written report reaches you within one business day. It is yours whether or not you buy.
- Requests
- 234/ 300 cap
- Elapsed
- 15:23/ 20:00
Sample check of acme.example: 234 read-only requests (GET and HEAD) over 15 minutes, never two in the same second. No host gets past 200 requests, the total stays under 300, and the check ends before 20 minutes.
- acme.example
- 124 of 200 requests
- shop.acme.example
- 23 of 200 requests
- api.acme.example
- 87 of 200 requests
- Requests
- About 300 at most
- Rate
- About 1 per second
- Duration
- About 20 minutes
- Report
- Within 1 business day
Nothing runs until you confirm on the form that you own the domain or may authorize testing on it.
Read-only, capped and counted.
Every request is a plain GET or HEAD on a page any visitor can reach. The check counts them against fixed caps: about 300 in all, about 200 on any one host, about one per second, and one window of about 20 minutes.
What it touches
- Your domain and its subdomains, found in public certificate logs and DNS records, never guessed by brute force
- Public pages only, with plain GET and HEAD requests
- At most about 300 requests in all and about 200 on any one host, about one per second
- One IP address for the whole check
- Your robots.txt: a path it disallows is skipped
What it never does
- Log in, keep cookies or open a session
- Send exploit payloads, fuzz forms or scan ports
- Write, post or upload anything to your systems
- Probe third-party hosts such as your CDN or hosting provider: they are recognised, not tested
If your site answers 429 Too Many Requests, or a run of 403s that looks like a block, the check stops there.
What your logs will show.
- Source
- One US residential IP address for the whole check. If that line drops, the check is re-run once, not more.
- Methods
- GET and HEAD only
- Rate
- About one request per second, about 300 at most
- Window
- One window of about 10 to 20 minutes
- Stop
- A 429 from your site ends the check
A written report, in plain words.
What we saw, what an attacker could do with it, and how urgent each item is. It is yours whether or not you buy.
- Each finding: what we saw, and the URL where we saw it
- What an attacker could do with it, in plain words
- How urgent it is: a severity on every finding
- The request that shows it, so your team can check it themselves
Nothing found? You still get an answer: an email that says so, and says what one outside check cannot cover.
From the form to your inbox.
- 01You ask
You enter your domain and your work email, and confirm you own the domain or may authorize testing on it. Nothing runs without that.
- 02The check runs
About 20 minutes, read-only. It starts as soon as a line is free. If none is, a researcher confirms your request and starts it.
- 03A researcher reads it
A researcher reviews the result before the report is sent.
- 04The report arrives
By email within one business day, with a link to the full report in your portal. The link works once, for 24 hours.
Send us your domain.
Your domain first, then your work email and your consent. The report goes to that email.
Your data
- We keep at most 2 KB of any page we read, with personal data redacted first.
- The report and the raw logs sit on EU servers. Email sales@rheono.dev and we delete them.
Not your domain, or you never want a check? Use the permanent opt-out.
The check reads the outside. A pentest goes further.
The free check reads only what any visitor can reach. A Rheono pentest tests behind the login, with the test accounts you provide, inside a scope you sign.