Protect what you've built.
Webforta checks your websites the way attackers look at them - exposed files, weak HTTPS, missing protections, expiring certificates, changed DNS - and tells you exactly how to fix each issue.
14-day trial, no card required. You can only scan websites you prove you own.
Everything a website needs to stay safe and online
Most compromises start with something simple: a forgotten backup, an expired certificate, a DNS record nobody changed on purpose. Webforta keeps watch on exactly those things.
Scan
A read-only security assessment of your verified website. Every finding shows the evidence we saw, why it matters and exactly how to fix it.
- HTTPS & redirects
- Security headers
- Cookies
- Exposed files
- Version leaks
Monitor
Know about downtime, slow responses, expiring certificates and unexpected DNS or header changes before your customers do.
- Uptime
- Response time
- Certificate expiry
- DNS changes
- Email alerts
Shield
Put Webforta in front of your site as a reverse-proxy web application firewall: block, rate-limit and challenge bad traffic at the edge before it reaches your server.
- Attack filter
- WordPress protection
- Traffic analytics
- Under attack mode
- IP & country rules
Reports
Turn real measurements into clear reports for clients and stakeholders - findings, availability, certificates and DNS history.
- Print to PDF
- CSV & JSON
- Client-ready
From sign-up to first findings in minutes
Add your website
Enter a domain. Agencies can add every client site to one organization.
Prove you own it
Publish one DNS record. Webforta never scans a site you haven't verified.
Scan and monitor
Run a read-only scan, then switch on uptime, certificate, DNS and header monitoring.
Fix and report
Follow the remediation for each finding and share a report when you're done.
Practical checks, explained in plain language
Webforta never runs exploits, guesses passwords or crawls your whole site. About 25 polite requests to your site per scan. They identify themselves as Webforta, except three page loads that look like a browser, Googlebot and a visitor from Google search, used to spot spam shown only to search engines.
See every check- Transport securityHTTPS, redirects, HSTS and certificate expiry.
- Headers & cookiesCSP, clickjacking, MIME sniffing, cookie flags.
- Exposed files.git, .env, database dumps, config backups.
- Technology leaksPlatform and version banners attackers use.
- DNS changesAlerts when records change unexpectedly.
- Mixed contentScripts and forms still loading over HTTP.
Simple plans that grow with you
Starter
For a single site that needs a reliable baseline.
€9 / month
- 1 website
- On-demand security scans (10 / month)
- Uptime & SSL monitoring (30-minute target interval)
- Security-header checks
- Email, Slack, Discord & Teams alerts
- Public status page
Pro
For freelancers and growing businesses with several sites.
€29 / month
- 5 websites
- Scheduled weekly security scans
- Monitoring (10-minute target interval)
- Historical findings (180 days)
- Downloadable reports with your logo
- Shield web application firewall
- REST API access
Business
For agencies and teams managing many client sites.
€79 / month
- 20 websites
- Scheduled daily security scans
- Monitoring (5-minute target interval)
- Historical findings (1 year)
- White-label client reports & status pages
- Team access (up to 10 members)
- Shield firewall & REST API
Prices exclude VAT. VAT is added at checkout where applicable based on your billing address and VAT status.
Honest about what we do, and what we don't
Security tools shouldn't oversell. Here's how Webforta works.
- A clean scan isn't a guarantee. Every report says what was checked and what wasn't.
- Charts and reports use real measurements only. No invented uptime numbers.
- Shield only sits in your traffic path once you point your DNS to Webforta, and it starts in monitor mode so nothing is blocked until you say so.
- No tracking cookies. IP addresses are stored only as keyed hashes.
Frequently asked
Do I need to install anything on my server?
No. Scanning and monitoring work from the outside using public HTTP/HTTPS requests and DNS. Shield (the firewall) is optional and only changes anything when you choose to point your domain’s DNS at Webforta.
Can I scan any website?
No. You can only scan websites whose ownership you verify with a DNS TXT record, and you must be authorized to test them. The free header check on the scanner page makes a single request, like a browser visit.
Does Webforta remove malware?
Not today. Webforta detects external indicators such as injected scripts, hidden spam links, cryptominers and exposed sensitive files. From the outside it cannot inspect files on your server; for WordPress, the optional Webforta Connector plugin checks core files, uploads and code from inside the site. Either way, Webforta does not certify a site as malware-free. See Malware detection for details.
Is Webforta a firewall?
Yes - Webforta Shield is a reverse-proxy web application firewall. You point your domain at Webforta with a DNS record, and it filters requests (an attack filter for SQL injection, XSS and path traversal, sensitive-file protection, WordPress protection, bad-bot challenges, IP and country rules, rate limiting and an under-attack mode) at the edge before forwarding clean traffic to your server. It starts in monitor mode so you can watch what it would block before enforcing.
How often does monitoring run?
Down to every 5 minutes on Business, 10 on Pro and 30 on Starter. A scheduler dispatches checks every 5 minutes, so actual spacing can vary slightly.
Is there a free plan?
Yes. The Free plan covers 1 website with 4 on-demand security scans a month and hourly uptime and SSL checks. Results are shown in your account (no email or chat alerts and no public status page). Paid plans add alerts, scheduled scans, reports, more websites and Shield.
Can I cancel anytime?
Yes. Cancel in the billing portal and keep access until the end of the paid period.
See what your website shows attackers
Start a 14-day trial, verify a domain and run your first scan in about ten minutes. No card required.