Security checks that read your site from outside
and alert you on signs of an attack.
Scripts and frames from a new host, links and text a visitor cannot see, spam words, redirects to another site, software on a list of exploited flaws and missing security headers. A finding is a lead with its evidence, not a verdict.
- From Solo
- Evidence on every finding
- Not a firewall
How it works
The first scan sets the starting point; later scans report what is new.
Add your site
The home page, the pages your checks monitor and some internal links are read, as many as the plan allows.
Scans read it as a browser
Each scan looks for what a visitor could not see and what should not be there, and keeps the evidence.
New warnings alert
The first scan sends nothing. New warnings after that reach your alert channels in one grouped message that starts with [SECURITY].
What you get
Seen or possible
Seen means the fact itself was observed; possible means an inference that can be harmless, such as a new analytics script.
Accept what you expect
Accept a finding as expected and later scans leave it out.
Deeper checks after a DNS proof
Well-known files such as .git and .env are asked for only after you prove the domain with a DNS record.
Matched against exploited flaws
The software and versions a site reports are checked against the CISA list of exploited flaws, the NVD and OSV.
Stack and vulnerability watch New
Part of every security scan: the software a site shows in public, checked against published advisories.
What it reads
The server and PHP versions in response headers, the generator tag of the CMS, plugin and theme versions in the addresses of their files, and JavaScript libraries such as jQuery: what any visitor’s browser gets.
What it checks
Each version it reads against CISA’s list of exploited flaws, NVD and OSV advisories and a list checked by hand. A flaw on CISA’s list is a warning; any other match is a notice.
What a match means
The version the site reports is inside an advisory’s range. It does not prove the site is vulnerable, and the finding says so.
What it does not do
It reads what a visitor’s browser gets and tells you what changed. These are its limits.
- No file scan. It does not read files on the server or the database.
- No cleaning. It does not remove malware or repair a site; it shows what to look at.
- No firewall. It does not block traffic or an attack while it happens.
- Nothing behind a login. It reads the public pages, as a visitor does.
- No proof of a flaw. A version inside an advisory’s range is a lead: hosts hide versions and distributions patch without changing the number.
Which plans include it
Security checks come with Solo and up; the plan sets how many pages each scan reads.
- FreeNot included
- SoloIncluded3 pages per scan
- TeamIncluded6 pages per scan
- AgencyIncluded10 pages per scan
- Agency PlusIncluded10 pages per scan
Questions about security checks
Can uptime monitoring detect a hacked site?
Not on its own. An uptime check sees the page answer, and an attack that keeps the page up shows only in what the page loads and links to: a script from a new host, hidden links, spam text or a redirect away. The security checks read those, from Solo.
Does a finding mean my site was hacked?
No. Every finding is a possible problem with its evidence, not a verdict that the site was hacked. Beamfar is not a firewall: it cannot block an attack or clean a site.
What can it not see?
Files on the server, the database, anything behind a login and an attack while it happens. A quiet scan only means the checks that ran saw nothing. Tested on test pages; not yet run on customers’ sites.
Does it pretend to be Googlebot?
Only for a site whose domain you proved with a DNS record and only while you switch it on; every other scan reads the site as a browser.
Can I check my headers without an account?
Yes: the free security headers checker reads one address now and stores nothing about it.
Read your pages the way a visitor gets them.
Add your sites: checking starts as soon as you do.
No card for the Free plan.