HTTP/HTTPS and headers
Checks HTTPS, redirects, and defensive headers that help reduce unnecessary exposure.
KAIROSETH SECURITYAVAILABLE
Website security audit to understand your posture before it becomes a problem.
Website Security Audit performs an authorized passive assessment of a website's public surface, turns technical findings into a clear score, and prioritizes what should be fixed first.
Passive assessment of authorized public targets
No exploitation, credentials, or intrusive testing
Clear reports for technical and business teams
WHAT YOU GET
From scattered technical signals to an action plan.
Website Security Audit combines web, TLS, DNS, email, and browser-facing controls into one assessment with scoring, context, and remediation.
TLS and certificates
Reviews protocol, encryption, certificate dates, and key strength from the public service perspective.
DNS and DNSSEC
Evaluates DNS configuration signals and the presence of DNSSEC as part of the domain's public posture.
SPF, DMARC and email
Checks SPF, DMARC, MTA-STS, and TLS-RPT to highlight domain email hardening opportunities.
CSP, cookies and redirects
Analyzes visible browser policies, cookie attributes, and redirect behavior.
security.txt and technology
Detects security.txt and performs lightweight technology identification without exploitation or intrusive enumeration.
WORDPRESS · WOOCOMMERCE
WordPress security from the public posture that can actually be observed.
WordPress and WooCommerce are a natural Website Security Audit use case: the product can review public signals such as HTTPS, TLS, defensive headers, cookies, DNS, email, and security.txt without exploiting plugins, testing credentials, or presenting itself as a penetration test.
Non-intrusive WordPress audit
Build a baseline of the public surface and prioritize observable findings without turning the assessment into exploitation or aggressive enumeration.
Headers, HTTPS, and configuration
Review signals such as CSP, HSTS, cookies, and redirects together with TLS and other public layers that also affect WordPress and WooCommerce.
Separate technical guidance
The security-headers guide explains technical hardening; this page remains the commercial owner of the assessment.
Read the WordPress security guide →HOW IT WORKS
Three steps to a useful security reading.
Add an authorized site
Enter the domain and confirm your organization owns or manages the target and is authorized to assess it.
Run the assessment
Kairoseth processes passive checks against the public surface under operational safety limits.
Prioritize and share
Review score, findings, remediation, history and, on Pro, generate a clean PDF or email the report.
REPORTING
Results designed to become decisions.
The report explains what was observed, why it matters, and what action is recommended. Free lets you evaluate the product with a clearly identified preview PDF; Pro generates clean reports ready for clients or internal teams.
SECURITY INSPECTOR
From finding to report.
The assessment keeps the technical context while presenting results so they can be reviewed, prioritized, and shared.
- Overall security score and grade
- Technical findings with contextual explanation
- Prioritized remediation and historical tracking
- Watermarked PDF on Free and clean PDF on Pro
- Report email for Pro Owner/Admin
PLANS
Start free. Expand when you need it.
Quotas are enforced server-side and Pro capacity belongs to the organization that activates Website Security Audit.
For trying the assessment and maintaining a basic security reference.
- 1 site
- 3 assessments per month
- Kairoseth-watermarked PDF
- Limited history and comparisons
- No report email
For organizations that need more capacity and client-ready results.
- Up to 10 sites
- 50 assessments per month
- Clean PDF
- Complete history and comparisons
- Report email
- Owner/Admin/Member product roles with scoped permissions
SAFETY AND AUTHORIZATION
Assess without turning the product into an intrusive scanner.
Website Security Audit is designed for public targets the organization owns, manages, or is authorized to assess. The product does not perform exploitation, credential attacks, private scanning, or destructive testing. Target authorization is recorded before an assessment can run.
TRUST & CONTROL
Authority stays explicit as the platform grows.
Kairoseth separates identity, organization scope, product roles and product capabilities. A login route, browser state or AI response never becomes an authorization boundary by itself.
SECURITY INSPECTORCONTROL PLANE
- Target
- Customer authorization
- Required
- Assessment
- Passive public surface
- Bounded
- Product
- Owner / Admin / Member
- Product-scoped
- Reports & plan
- Server policy
- Controlled
Organization scope
Customer resources and access are resolved inside an active organization context rather than treated as global account state.
Product-scoped roles
Owner, Admin and Member authority is assigned per product. Organization membership alone does not automatically grant every product.
Server authority
Sensitive access, policy and capability decisions remain authoritative on the server instead of trusting client UI state or model output.
Controlled execution
Capabilities that can act are introduced behind explicit grants, staged gates and audit rather than implied autonomy.
Public trust evidence
Review the customer-facing policies that define privacy, security reporting, acceptable use and the current legal operating framework.
FREQUENTLY ASKED QUESTIONS
What to know before you start.
Does Website Security Audit hack or exploit my website?
No. Commercial v1 is passive and limited to authorized public signals. It does not perform exploitation, password attacks, or destructive testing.
Do I need to install anything on my server?
Not for the current assessment. Add the authorized domain in Kairoseth and the analysis runs against the accessible public surface.
What is the difference between Free and Pro?
Free includes 1 site, 3 monthly assessments, and a watermarked PDF. Pro expands to 10 sites and 50 monthly assessments, adds clean PDF, complete history/comparisons, and report email.
Can I share the report with a client?
Yes. Pro can generate a clean PDF. Product Owner and Product Admin can also email the report from the assessment result.
Does the result guarantee that a website is secure?
No. The report reflects observable public signals at that time. It helps prioritize improvements but does not replace a full audit, penetration test, or code review when those are required.
Who can run assessments?
Users need product access within an organization and must confirm target authorization. Kairoseth applies organization- and product-scoped permissions.
START NOW
Get a first reading of your website posture in Kairoseth.
Create your account, activate Website Security Audit for your organization, and add an authorized site.