Know your site is secure.
hexora · scan example.com
$
passive scan · no payloads · authorised target
- SSL/TLS configuration
- Security headers
- Cookie security
- CORS configuration
- Exposed secrets
- DNS and email auth
- Tech fingerprinting
0 findings · scanning
7
Scanners in parallel
Small numbers, updated as scans complete. We count what is real, nothing inflated.
Security scanning that actually finds things.
Professional-grade results without enterprise complexity.
Deeper scanning, real findings
Hexora runs seven security scanners in parallel, checking SSL/TLS, headers, CORS, cookies, DNS, exposed secrets, and technology fingerprinting. Every finding includes evidence and context, not just a pass/fail.
- ssl_tls
- headers
- cors
- cookies
- dns_email
- secrets
- fingerprint
- + more added regularly
Fix it in your next commit
Every vulnerability comes with a step-by-step remediation guide written by a security practitioner, a CVSS score for prioritisation, and an AI-ready fix prompt you can paste directly into Claude, Cursor, or Copilot.
Compliance-ready from day one
Hexora maps every finding to Cyber Essentials, ISO 27001, SOC 2, and OWASP Top 10. Know where you stand on compliance without reading the frameworks yourself.
Evidence in,
fix prompt out.
No generic advice. Every finding shows the exact header, response line or record that triggered it, a CVSS score so you know what to fix first, and the compliance frameworks it maps to.
Then the part that actually ships the patch: a ready-made prompt written for AI coding agents. Copy it, paste it, commit the fix.
Missing Content-Security-Policy Header
My site failed a security scan: the HTTP response from my server is missing a Content-Security-Policy header. Add a strict CSP header to my server config or middleware. Start with default-src 'self', audit which external origins my app loads scripts and styles from, and allowlist only those. Show me the exact change for my stack.
Paste into Claude · Cursor · GitHub Copilot
Three steps.
Under 60 seconds.
No agents to install, no credentials to hand over. A scan is no different from a browser visit.
Ship your app, paste the URL
Already shipping with Cursor or Copilot? Paste the URL once you have deployed and get your security report in under 60 seconds.
$ hexora scan https://yourapp.com
Hexora scans for real vulnerabilities
Seven security scanners run in parallel: SSL/TLS, CORS misconfigurations, exposed secrets, security headers, cookie weaknesses, DNS problems, and tech fingerprinting.
7/7 scanners · passive only · ~12s
Copy the fix into your coding agent
Each finding includes a ready-to-paste fix prompt. Drop it straight into Claude, Cursor, or Copilot and ship the patch.
→ prompt copied · paste · commit
Simple, transparent pricing.
No surprises. Cancel any time.
| Compare plans | Free Try Hexora risk-free. Free | Starter For freelancers and small projects. £15/mo | ProMost popular For teams shipping regularly. £39/mo | Max Unlimited everything for agencies. £89/mo |
|---|---|---|---|---|
| Domains | 1 | 3 | 10 | Unlimited |
| Scans per month | 3 | 50 | 200 | Unlimited |
| Full scan results | ||||
| Evidence and remediation | ||||
| AI fix prompts | ||||
| PDF scan reports | ||||
| Priority support |
Free
Try Hexora risk-free.
- Domains1
- Scans per month3
- Full scan results
- Evidence and remediation
- AI fix prompts
- PDF scan reports
- Priority support
Starter
For freelancers and small projects.
- Domains3
- Scans per month50
- Full scan results
- Evidence and remediation
- AI fix prompts
- PDF scan reports
- Priority support
Pro
Most popularFor teams shipping regularly.
- Domains10
- Scans per month200
- Full scan results
- Evidence and remediation
- AI fix prompts
- PDF scan reports
- Priority support
Max
Unlimited everything for agencies.
- DomainsUnlimited
- Scans per monthUnlimited
- Full scan results
- Evidence and remediation
- AI fix prompts
- PDF scan reports
- Priority support
No credit card required on the free plan. Annual billing saves 25% on all paid plans.
Frequently asked
questions.
Ten answers, grouped by what you are actually trying to decide.
Most scans complete in under 15 seconds. Hexora runs seven security checks in parallel, covering SSL/TLS configuration, security headers, CORS policy, cookie security, exposed secrets, DNS and email authentication, and technology fingerprinting.
Yes. Hexora uses passive scanning only, meaning it analyses your site's responses without sending any malicious payloads or attempting exploitation. It's no different from a regular browser visit. Your site won't be affected.
Domain verification proves you own a domain and is used for features like scheduled scans and team access. For basic scanning, no verification is needed. If your email address matches the domain (e.g. you@yoursite.com for yoursite.com), you can verify in one click. Otherwise, you can add a DNS TXT record.
Hexora checks for missing or misconfigured security headers, SSL/TLS issues, CORS misconfigurations, insecure cookies, exposed sensitive files, weak DNS and email authentication (SPF, DKIM, DMARC), and identifies the technologies your site is running. More scanners are being added regularly.
Yes. Subdomains (e.g. app.example.com, api.example.com) are scanned exactly like any other URL, and you get the full results either way. If you do verify a domain, verifying the root (e.g. example.com) covers all of its subdomains, so you never need to verify each one separately.
The free plan gives you full scan results for one domain, with up to 3 scans per month. You get all findings, evidence, and remediation guidance. Upgrade to a paid plan for AI fix prompts and PDF reports. No credit card required.
Yes. All paid plans are available with annual billing at a 25% discount. You can switch between monthly and annual billing at any time from your account settings.
Yes. Paid plans include downloadable PDF reports for every completed scan, with full findings, evidence, and fix prompts included.
Each finding on a paid plan includes a ready-made prompt you can paste into Claude, Cursor, GitHub Copilot, or any AI coding tool. The prompt explains the issue and tells the AI exactly how to fix it in your codebase. No security expertise required.
Hexora is built by security professionals who understand what attackers actually look for. Every finding includes real evidence from your site and clear remediation steps, not generic advice. Results come with AI fix prompts you can paste straight into your coding tools to resolve issues immediately.