Find what attackers can see on your site, before they do
Outside-in security monitoring for live websites. Wardzo finds leaked API keys in JavaScript, exposed .env and .git files, weak security headers, SSL problems and cloaking, then tells you how to fix them.
Most website breaches that hit small teams are not clever exploits. They are things left in public by accident: an API key bundled into JavaScript, a .env file the web server happily serves, a .git folder copied to production, or a certificate that quietly expired. Wardzo checks for exactly these, on every scan.
What Wardzo checks
Secrets in your public JavaScript
Wardzo downloads the JavaScript files your pages actually load and looks for credential patterns from OpenAI, Anthropic, Stripe, AWS, GitHub, Slack, SendGrid, private keys and Google. For Supabase it decodes the key and tells you whether it is the public anon key (fine) or a service_role key (critical). We only ever show and store a masked prefix of anything we find.
Exposed files
A short, fixed list of well-known paths such as /.env, /.git/HEAD, /.git/config, WordPress config backups, .htpasswd, SQL dumps, .npmrc, docker-compose.yml, phpinfo and server-status. Each one is fetched once and the content is verified against a signature, so a custom 404 page that returns 200 OK is not reported as a leak.
HTTPS, SSL and security headers
Certificate validity and expiry, TLS version, HTTP to HTTPS redirects, HSTS, Content-Security-Policy, clickjacking protection, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, cookie flags, mixed content and server version disclosure.
Cloaking and malicious redirects
Hacked sites often show spam only to Google. Wardzo fetches your homepage as a regular browser and as Googlebot and compares the two: different redirects, different status codes or spam keywords that appear only for the crawler.
How findings are reported
Every finding has a severity (critical, high, medium, low or info), the evidence we saw, why it matters and how to fix it. Each one can be copied as Markdown so you can paste it straight into your AI coding assistant.
Deeper checks for verified domains
Some checks are only appropriate when you have proven the site is yours. Verify your domain with a DNS TXT record, a meta tag or a file in /.well-known/ from your dashboard. Deep checks for verified domains are on the roadmap for paid plans.
Frequently asked questions
Does Wardzo need access to my code or server?
No. Every check uses only what your site serves publicly to any visitor. There is no plugin, agent or repository access.
Is the security scan safe to run on a production site?
Yes. Checks are passive and rate-limited. Wardzo makes one request per known path, never sends attack payloads, never guesses passwords and never port-scans.
What can an outside-in scanner not see?
Server-side code, databases, admin panels behind a login and anything not reachable from the public internet. Wardzo is a monitoring layer, not a replacement for a code review or a penetration test.
Related
- Leaked API key checker
Free tool that scans the JavaScript your website serves for leaked secret API keys from OpenAI, Anthropic, Stripe, AWS, GitHub, Supabase and more. Results are masked and never stored in full.
- Exposed .env and .git file checker
Free tool that checks whether your website publicly serves sensitive files such as .env, .git, wp-config backups, SQL dumps, .npmrc or source maps, with content verification to avoid false positives.
- Security headers checker
Free security headers checker. Test HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, SSL certificate expiry, TLS version and mixed content.