Security scanning built for people who build websites
Warden makes enterprise-grade web security checks accessible to freelancers, agencies, and small teams — without the enterprise price tag or the expertise requirement.
Security audits shouldn't require a six-figure budget
Qualys Web Application Scanning starts at $1,995/year for 25 applications. Intruder's entry tier is $149/month. Acunetix and Invicti require custom quotes that rarely come back under $4,000 per year. None of these make sense for a developer with three client sites or a startup trying to pass a security audit.
Meanwhile, clients and procurement teams are asking more questions about security than ever. Supplier audits, insurance requirements, and enterprise procurement checklists increasingly demand documented evidence that your website is secure.
Security expertise required
Automated security checks per scan
Starting price per month — no minimum term
What we check
30+ security checks, grouped by area
Warden is an automated DAST platform — dynamic application security testing, run against your live site rather than your source code. Standard checks are read-only and non-destructive, so your site stays live throughout. The optional Deep Scan adds active testing you authorize separately per domain: it submits forms, probes for injection flaws, and — if you add a test account — signs in and scans the parts of your application that sit behind a login.
TLS protocol version
Cipher suite strength
Certificate validity
Certificate chain
HSTS header
HSTS preloading
Certificate-expiry email alerts
Content-Security-Policy
X-Frame-Options
X-Content-Type-Options
Referrer-Policy
Permissions-Policy
Cross-Origin policies
Secure flag
HttpOnly flag
SameSite attribute
Cookie scoping
Server version disclosure
Technology fingerprinting
Sensitive file exposure
Directory listing
Backup file detection
HTTP to HTTPS redirect
Mixed content detection
HTTP methods allowed
Clickjacking protection
AI chatbot & LLM surface detection
AI surface classification
Prompt-injection probing of a chatbot endpoint you configure and authorize (part of Deep Scan)
Cross-site scripting (XSS) — reflected and stored
SQL injection
Path traversal & local file inclusion
Command injection
Server-side request forgery (SSRF)
Open redirects
Built on OWASP ZAP, the industry-standard open-source scanner
Active testing you authorize separately, per domain — it never runs unless you switch it on
Add a test account and Deep Scan signs in before it scans
Form-login and session handling, so the scan reaches pages behind your login
Session-cookie and post-authentication header checks
Privilege escalation — whether a standard user can reach admin-only pages
Cross-account access — whether one account can read another account's records (broken access control)
Browser-rendered crawling for single-page applications
Import an OpenAPI or Swagger document to map your documented API surface
Whether endpoints require authentication
Whether rate limiting is applied
Whether responses leak sensitive fields
Whether one account can read another account's records through the API
CWE / OWASP / CVSS tagging on findings
PCI DSS control mapping
ISO 27001 control mapping
SOC 2 control mapping
Cyber Essentials & OWASP ASVS mapping
Control coverage rollup — see which ISO 27001 Annex A controls have open findings (Pro and up)
Your report contributes vulnerability-assessment evidence toward ISO 27001 control A.8.8
Paste your composer or npm lockfile and we flag known-vulnerable libraries — free on every plan.
We flag abandoned, deprecated, or risky libraries in your stack.
Every plan shows your domain's registration expiry date and registrar; Starter and up adds two email reminders before it lapses, so your site and email never go dark.
XML-RPC exposure
REST API user enumeration
readme.html version disclosure
Exposed debug log
Detected versions checked daily against official vendor release schedules
End-of-life software flagged as a real risk, not a routine note
Supported-but-behind versions noted for update
Page-by-page titles, meta descriptions & headings
Open Graph / Twitter Card & structured data
Image alt text, URL structure & page size
Sitemap, robots.txt & HTTPS redirect (site-wide)
0–100 score with plain-English fixes — informational, never affects your grade
AI deep dive for suggested fixes (Pro and up)
Crawls your public pages into a page inventory
Forms & login forms, with form-protection detection
External links, email addresses & third-party scripts
Broken-link detection
Informational site map — never affects your grade
TLS cipher/protocol grading
Subdomain discovery & takeover detection
Known-CVE / patch intelligence
Port & service exposure
Every scan automatically checks whether your site exposes a chatbot or LLM endpoint. Actually testing it — sending it prompts to see how it responds — is a separate, on-demand test you configure and authorize yourself; Warden never probes an AI surface without your consent.
An authorized, on-demand test that sends adversarial prompts to your own configured chatbot endpoint to check whether it ignores its instructions, leaks its system prompt, or discloses sensitive data. Part of Deep Scan, available on the Pro plan and above, and only ever run against domains you've verified and consented to test.
The process
From sign-up to a graded report — no weeks-long wait
Create your account
Sign up in under 2 minutes and pick the plan that fits.
Add and verify a domain
Add a DNS TXT record or upload a small verification file. Takes under 5 minutes and confirms you're authorised to scan.
Run a scan
Click scan. Warden runs 30+ automated checks in the background — standard checks are read-only, and the optional Deep Scan adds active testing you authorize separately. You'll receive an email when it's ready.
Review your report
View your A–F grade, health score, and findings with plain-English explanations and step-by-step fix instructions.
Fix and re-scan
Resolve findings using the guidance in your report, then mark them Fixed — Warden automatically rescans to verify and re-grades your report, so your score updates without waiting for your next scheduled scan.
Automate with scheduled rescans
Set a weekly or monthly cadence so Warden rescans your domain automatically and keeps your report current — no need to remember to click scan.
Who Warden is for
Built for builders, not enterprises
Freelance developer
Deliver a security report alongside every site launch. Demonstrate professionalism and add a high-value deliverable to your service.
Digital agency
Scan all your client sites from one dashboard. White-label reports under your own branding. Add a recurring security service line.
SaaS startup
Pass supplier security audits and enterprise procurement checklists with an independent third-party report. Automated — no weeks-long wait.
IT manager
Monitor your organisation's web properties continuously. Get alerted to new issues between scans. Keep your board informed.
Marketing team
Your website is a business-critical asset. Know its security posture without needing IT to run a report. Quick, clear, actionable.
How we compare
Warden vs the alternatives
| Feature | Warden | Competitors | Manual pen test |
|---|---|---|---|
| Entry price | $14.99/mo | $149–$1,995/mo | $2,000–$20,000+ |
| Getting your report | Automated, self-service | Automated, self-service | 2–6 week engagement |
| Active DAST (XSS / SQL injection) | ✓ (Pro+, authorized) | ✓ | ✓ |
| Authenticated scanning | ✓ (Pro+) | Enterprise tiers only | ✓ |
| API / OpenAPI testing | ✓ (Pro+) | Varies | ✓ |
| Broken access control (IDOR) | ✓ (Pro+, two test accounts) | Rarely | ✓ |
| Business-logic & chained exploits | ✗ | ✗ | ✓ |
| Plain-English findings | ✓ | Varies | Varies |
| No security expertise needed | ✓ | ✗ | ✗ |
| PDF report for clients | ✓ | ✓ | ✓ |
| Monthly billing available | ✓ | Often annual-only | N/A |
| White-label available | ✓ (Agency+) | Rarely | Depends |
| Compliance mapping (PCI DSS / ISO 27001 / SOC 2) | ✓ | Varies | ✓ (bespoke) |
| Slack / webhook / Jira integrations | ✓ | Enterprise tiers only | N/A |
| Fix-verification rescans | ✓ | Rarely | Extra cost |
| REST API access | ✓ (Business) | Enterprise tiers only | N/A |
| Scheduled rescans | ✓ | ✓ | N/A |
Ready to find out your security grade?
Every plan includes the full scan engine. Cancel any time.