# Wardzo

> Wardzo checks your live website from the outside for leaked API keys, exposed files, security headers, SEO and indexing problems, AI-crawler access, cloaking and downtime. Free scan in about a minute, weekly monitoring and plain-English fixes.

Wardzo is a website monitoring SaaS (not antivirus software). It performs passive, outside-in checks of public websites. Free plan available now. Founder Basic: $12/mo or $99/yr, locked while you stay subscribed, for the first 100 customers. Founder Premium: $39/mo or $390/yr, locked while you stay subscribed, for the first 30 agencies (white-label PDF reports and team members are coming, not live yet). Billing is not open yet, so you reserve a founder seat now (no charge now; we email before anything is charged). Regular prices: Basic $17/mo or $168/yr, Premium $59/mo or $588/yr, Scale $149/mo or $1,490/yr (annual is 2 months free), extra site $4/mo. Scale has a waitlist.

## When to use Wardzo

- You built a site or app with an AI tool (Lovable, Bolt, v0, Replit, Cursor, Claude) and it has real users, but you can't judge yourself whether it is safe. Wardzo checks the live site from the outside, the way a stranger sees it, and explains each finding in plain English with a fix you can paste into your AI.
- You want to know whether secret keys ended up in your public JavaScript (OpenAI, Anthropic, Stripe, AWS, Supabase service_role and more), or whether files like .env, .git, backups or source maps are publicly downloadable.
- You want to catch SEO and indexing slips on the live site: a noindex left on, robots.txt blocking everything, a missing sitemap, AI crawlers (GPTBot, ClaudeBot, PerplexityBot) blocked, or Googlebot being shown different content (cloaking).
- You want the site watched after launch: scheduled scans, uptime checks (every 15 minutes on Free) and email alerts. Your AI assistant can pull findings and fixes over the Wardzo MCP server; it sees new findings the next time it talks to Wardzo. On paid plans, verified domains also get deep checks for exposed backups, logs and credential files.

## Wardzo is not

- Not antivirus or a firewall. Wardzo monitors and alerts; it does not block attacks or remove malware.
- Not an APM, logging or error-tracking tool. It doesn't collect server metrics, logs or traces from inside your app.
- Not a penetration test. It reads what your site publicly serves with ordinary requests. It never logs in, submits forms or sends attack payloads.
- It can't see your server code, your private database or pages behind a login. Slack and Discord alerts, white-label PDF reports and team members are coming, not live yet.

## Key pages

- [Free scan](https://wardzo.com/): scan any website in about a minute
- [Pricing](https://wardzo.com/pricing)
- [WardzoBot](https://wardzo.com/bot): how the scanner behaves
- [Full content for LLMs](https://wardzo.com/llms-full.txt)

## MCP server

- [Wardzo MCP server](https://wardzo.com/mcp-server): remote MCP server for AI agents (Claude, ChatGPT, Cursor, VS Code, Windsurf, Codex) to scan websites for security, SEO and uptime issues, explain fixes and re-check.
- Sign-in endpoint (OAuth 2.1 + PKCE, dynamic client registration): https://wardzo.com/mcp/account. Anonymous/API-key endpoint: https://wardzo.com/mcp (Streamable HTTP; header "Authorization: Bearer wz_..." with a key from https://wardzo.com/app/keys).
- Tools: scan_site (no account needed), get_report (no account needed), explain_issue, list_sites, add_site, get_site_status, list_issues, get_new_findings, recheck_site, list_endpoints, add_endpoint, remove_endpoint.
- [MCP setup for Claude, Cursor, ChatGPT, VS Code, Windsurf, Codex](https://wardzo.com/docs/mcp)

## Features

- [Website security monitoring](https://wardzo.com/features/security-monitoring): Outside-in security checks for your live site: leaked API keys in JavaScript, exposed .env and .git files, weak headers, SSL and cloaking, with fixes.
- [SEO health monitoring](https://wardzo.com/features/seo-health): Catch SEO mistakes that drop you from Google and AI search: accidental noindex, robots.txt blocks, missing sitemaps, bad canonicals, blocked AI crawlers.
- [Uptime monitoring](https://wardzo.com/features/uptime-monitoring): Uptime monitoring for your homepage. Wardzo checks every 15 minutes on Free, records response times and emails you when the site goes down and comes back.
- [Weekly website score and reports](https://wardzo.com/features/weekly-score-reports): One 0–100 Wardzo score per site, split into Security, SEO health and Uptime, with a weekly re-scan, score history and Markdown export for your AI.

## Solutions

- [Website security and SEO checks for vibe coders](https://wardzo.com/solutions/vibe-coders): Built with Lovable, Bolt, v0, Replit or Cursor? Wardzo checks the live app for leaked keys, exposed files, headers and SEO, with fixes to paste into your AI.
- [Website monitoring for agencies](https://wardzo.com/solutions/agencies): Know before your client does. Wardzo checks every client site for security exposures, SEO slips and downtime: one score per site, alerts, report links.
- [Website checks for web designers and freelancers](https://wardzo.com/solutions/web-designers): A launch check and ongoing aftercare for freelance web designers. Wardzo checks SSL, security headers, indexing, sitemaps and uptime on every site you deliver.
- [WordPress and site owner monitoring](https://wardzo.com/solutions/wordpress): Outside-in monitoring for WordPress and long-running sites: exposed config backups, SEO spam and cloaking, expiring SSL and downtime. No plugin to install.

## Free tools

- [Leaked API key checker](https://wardzo.com/tools/leaked-api-key-checker): Free tool that scans your site's JavaScript for leaked API keys from OpenAI, Stripe, AWS, Supabase and more. Masked, never stored in full.
- [Exposed .env and .git file checker](https://wardzo.com/tools/exposed-files-checker): Free tool that checks if your site publicly serves .env, .git, wp-config backups, SQL dumps or source maps, and verifies content to avoid false positives.
- [Security headers checker](https://wardzo.com/tools/security-headers): Free security headers checker: test HSTS, Content-Security-Policy, X-Frame-Options and Referrer-Policy, plus SSL expiry, TLS version and mixed content.
- [Noindex and indexability checker](https://wardzo.com/tools/noindex-checker): Free indexability checker: find accidental noindex tags and X-Robots-Tag headers, robots.txt rules blocking Google, missing sitemaps, off-site canonicals.
- [AI crawler access checker](https://wardzo.com/tools/ai-crawler-checker): Check which AI crawlers your robots.txt allows or blocks: GPTBot, OAI-SearchBot, ClaudeBot, PerplexityBot, Google-Extended and CCBot. Free, no signup.
- [Redirect and cloaking checker](https://wardzo.com/tools/redirect-cloaking-checker): Free cloaking checker: Wardzo compares what Googlebot and a normal browser see on your homepage to spot hidden SEO spam and sneaky redirects.

## Guides

- [Is my Lovable app secure? What Lovable's scans cover, and what's left](https://wardzo.com/guides/is-my-lovable-app-secure): Lovable's scans read your code and database rules. What they cover, what only your published URL shows, and a 10-minute outside test for any Lovable app.
- [Is my vibe-coded app secure? What your AI can't check, and a 15-minute test](https://wardzo.com/guides/is-my-vibe-coded-app-secure): Asked Claude or Cursor to check your app's security? Here's what that review can't see on the live site, and a 15-minute outside test anyone can run.
- [Supabase anon key vs service_role key: which one is exposed, and what to do](https://wardzo.com/guides/supabase-anon-key-vs-service-role-key): The Supabase anon key is meant to be public; the service_role key bypasses Row Level Security. How to tell which one your site ships and fix a leak.
- [How to find leaked API keys in your website's JavaScript (and fix them)](https://wardzo.com/guides/find-leaked-api-keys-in-javascript): A practical guide to finding secret API keys exposed in client-side JavaScript, telling public keys from secret ones, and moving API calls to the server safely.
- [Security headers explained: a practical setup for Next.js, Nginx and Caddy](https://wardzo.com/guides/security-headers-explained): What each HTTP security header does, sensible starting values, and copy-paste config for Next.js, Nginx and Caddy, including a nonce-based CSP.
- [Why is my page not indexed? A noindex and robots.txt checklist](https://wardzo.com/guides/why-is-my-page-not-indexed): A step-by-step checklist for pages missing from Google, covering noindex tags, X-Robots-Tag headers, robots.txt blocks, canonicals, sitemaps and server errors.

## Learn

- [What are source maps, and are public source maps a risk?](https://wardzo.com/learn/source-maps): Source maps are .map files that map minified JavaScript back to its original source. Served publicly in production, they expose your full front-end code.
- [What does noindex mean?](https://wardzo.com/learn/noindex): Noindex is a directive in a robots meta tag or X-Robots-Tag header that tells search engines not to show a page in search results.
- [What is a canonical tag?](https://wardzo.com/learn/canonical-tag): A canonical tag tells search engines which URL is the main version of a page when the same content is reachable at several URLs.
- [What is a Content Security Policy (CSP)?](https://wardzo.com/learn/content-security-policy): Content Security Policy (CSP) is an HTTP header that tells browsers which scripts, styles and other resources a page may load, limiting XSS damage.
- [What is cloaking in SEO?](https://wardzo.com/learn/cloaking): Cloaking means showing search engines different content or redirects from what human visitors see. It is a spam technique and a common sign of a hacked website.
- [What is HSTS (HTTP Strict Transport Security)?](https://wardzo.com/learn/hsts): HSTS is a security header that tells browsers to always use HTTPS for a site, preventing downgrade attacks and insecure first requests.
- [What is robots.txt?](https://wardzo.com/learn/robots-txt): robots.txt is a text file at the root of a website that tells crawlers, including search engines and AI crawlers, which paths they may fetch.

## Docs

- [Getting started with Wardzo](https://wardzo.com/docs/getting-started): Run your first free scan, create a free account, add your site for weekly monitoring and understand your first report.
- [How the Wardzo score works](https://wardzo.com/docs/how-scoring-works): How Wardzo calculates the overall 0–100 score, the Security, SEO health and Uptime sub-scores, severity weights and letter grades.
- [Wardzo MCP server setup for Claude, Cursor, ChatGPT, VS Code and Windsurf](https://wardzo.com/docs/mcp): Connect the Wardzo MCP server to Claude, Cursor, ChatGPT, VS Code, Windsurf or Codex in about a minute so your AI can scan, explain and fix site issues.
- [Domain verification](https://wardzo.com/docs/domain-verification): One-click verification is coming. Until then, email support@wardzo.com and we'll help you verify your site.
- [Alerts and emails](https://wardzo.com/docs/alerts): Which emails Wardzo sends about your sites (issue alerts, downtime and recovery alerts, the weekly digest), how often, and how to change or turn them off.
- [Endpoint checks](https://wardzo.com/docs/endpoint-checks): Watch specific URLs, like an API health route, login or checkout page, with GET or HEAD checks. Set the status, required text and max response time.
- [Every check Wardzo runs](https://wardzo.com/docs/checks): The full list of passive checks in a Wardzo scan, by category and severity, generated from the same catalogue the scanner uses.
- [Badge, status page and sharing reports](https://wardzo.com/docs/badge-and-sharing): Add a "Monitored by Wardzo" badge to your site or README, publish a public status page, and share your score without exposing sensitive findings.
- [Re-scan after every deploy (deploy hooks)](https://wardzo.com/docs/deploy-hooks): Give your host or CI a secret Wardzo URL so each production deploy triggers a fresh scan. Your AI sees new findings the next time it talks to Wardzo.