Skip to content
isyoursitesafe
Menu

Website security you can prove

A dated security report you can hand your insurer, your customer or your host. Today.

We find it, we fix it, we re-scan and prove it's gone. Start with the free check: 14 of 61 published checks, with the report sent to your inbox.

The four moments that ask for proof:

  • Insurer questionnaire
  • Client due diligence
  • A warning from your host
  • After an incident

Free. 14 of 61 checks. Next step: the email address the report goes to.

Confirmed tracked losses since 1 Oct 2026 — a floor, not a total

$6,302,600,000all estimates

2 events, each listed below with its sources. Last updated 2 Nov 2026, 4:59 PM MST.

  • Binance$6,300,000,000 (estimate)

    29 Oct 2026 · Sources: BleepingComputer (link pending); Wikipedia / TRM Labs (link pending)

  • Polymarket$2,600,000 (estimate)

    29 Oct 2026 · Sources: pending vetting

What this number is, and isn't

It is the sum of the rows above, nothing else. A headline in the ticker never moves it. Rows are added, never overwritten; a revised figure is a new row.

It is not the cost of cybercrime. Nobody knows that number. Amounts marked estimate are estimates. A free website check would not have prevented any of these losses.

Headlines from our sources

Updated 2 Nov 2026, 4:59 PM MST

  • 4–6 Oct 2026BleepingComputerSmall-site stack

    Ninja Forms XSS exploited to plant hidden admin accounts — 500,000+ sites

    Why you: A form plugin like the one on your contact page.

  • Date pendingSource pendingSmall-site stack

    WPC Product Bundles for WooCommerce exploited — 30,000+ sites, hidden admins "the site owner cannot see"

    Why you: A shop add-on, and admin accounts you would never see.

  • Oct 2026Source pendingSmall-site stack

    Rank Math PRO backdoor, self-restored for 11 hours

    Why you: An SEO plugin, the kind installed once and forgotten.

  • 21 Oct 2026Source pendingSmall-site stack

    PHP2Shell — exploited BEFORE the fix shipped, CISA KEV added

    Why you: Under every WooCommerce shop.

  • 16–20 Oct 2026Source pendingSmall-site stack

    Plex2Shell exploited in the wild, miners landing on unpatched servers in a day

    Why you: An unpatched server falls in a day.

  • Date pendingSource pendingSmall-site stack

    C3RB3R ransomware on unpatched Synology DSM — no decryption reported

    Why you: The small-office file server.

  • 13–17 Sep 2026TechRadar; Emery ReddySmall-site stack

    BigCommerce/Ribon app-key breach — merchant storefront scripts malicious, SMB e-comm buyers notified names/emails/phones exposed

    Why you: One app key, and your storefront scripts turn on your buyers.

  • 14–19 Oct 2026Source pending

    Zeabur: 321,810 accounts, unrotated creds killed the host

    Why you: Credentials nobody rotated.

  • 20–22 Oct 2026Source pending

    Railway: customer secrets stolen, AI keys the target

    Why you: AI keys are the new thing worth stealing.

  • 21 Oct 2026Source pending

    LiteLLM malicious release live ~100 min

    Why you: A trusted update channel became the attack path.

  • 17–26 Oct 2026Source pending

    eMudhra CA intermediate key value "4"

    Why you: Even certificate trust wobbles.

  • 27 Oct 2026Source pending

    Sony So-net 2,585,481 records

    Why you: A plain ISP breach.

  • 19 Oct 2026Source pending

    Capcom ~11.77M records

    Why you: Credential hygiene at a giant.

  • 13–21 Oct 2026Source pending

    ConnectWise→M365: one app credential, 162→2,250+ tenants

    Why you: One app credential, small-business scale.

  • 21 Oct 2026Source pending

    Quest Diagnostics SEC filing

    Why you: Healthcare exposure, disclosed to the SEC.

  • 21 Oct 2026Source pending

    GMO Onamae 26,739 VPS users

    Why you: Cloud servers owned by small traders.

  • 29 Oct 2026BleepingComputer; Wikipedia / TRM Labs

    Binance: ~$6.3B stolen (preliminary estimate), ~$3B frozen — largest theft in crypto history

    Why you: Context, not your risk: an exchange, not a small site.

  • 29 Oct 2026Source pending

    Polymarket: ~$2.6M (est. $2.5–2.7M) lost to a third-party script compromise

    Why you: One bad vendor script.

  • 2026Source pending

    Marks & Spencer (UK) ransomware: £300,000,000 est. total impact

    Why you: Enterprise context, not small-business framing.

  • Date pendingSource pending

    Jaguar Land Rover: ~£1.9B est., 5-week shutdown

    Why you: Enterprise context, not small-business framing.

Headlines are reported by the outlets named; we haven't verified them, and source links are attached as each row is vetted. Scroll the row to read every headline. Same stack as yours? Run the free check.

Black October

October 2026 was loud. What reaches a small website is quieter.

About 106 dated incidents in one month [AgentBeam tracker via explainx.ai, checked 1 Nov 2026], including the largest theft in crypto history: about $6.3 billion from Binance on 29 October [Ticker seed v1, checked 2 Nov 2026]. Those are the headlines.

Small businesses get hit by smaller things: an old plugin, a forgotten DNS record, a key left in a page. 96% of ransomware victims with a known size are small and mid-sized businesses [Verizon DBIR 2026, checked 2 Nov 2026].

The plugin you didn't update

A plugin goes on once and is forgotten. In early October, attackers used a hole in the Ninja Forms plugin to plant hidden admin accounts on 500,000+ sites [BleepingComputer, 4–6 Oct 2026, via ticker seed v1, checked 2 Nov 2026]. A WooCommerce add-on did the same on 30,000+ more, with admins “the site owner cannot see” [WPC Product Bundles, ticker seed v1; outlet pending, checked 2 Nov 2026].

What catches it: checks 40 to 42 (CMS, version and plugin detection) in the Site Report.

Check your site free

The DNS record pointing at nothing

A subdomain still points at a service you cancelled. Whoever claims that service can publish pages under your name.

What catches it: check 11, unclaimed CNAME targets. We report candidates; we never claim them.

Check your site free

The password in your page's source

Keys and passwords end up in JavaScript and in files left on the server. In October, a hosting platform's customers had their secrets stolen; AI keys were the target [Railway, 20–22 Oct 2026, via ticker seed v1, checked 2 Nov 2026].

What catches it: check 32 (.git, .env and backup files) runs on the free check; check 56 (AI keys in JavaScript) runs on Complete.

Check your site free

How the free check works

  1. Step 1

    You give us one address.

    No login, no install, no access to your site's admin.

  2. Step 2

    We run the Safe Profile.

    Passive and single-request checks: DNS, certificates, headers, cookies and a light crawl of about 12 pages. Our scanner sends its own requests and names itself on the scanner identity page. Nothing aggressive runs without your opt-in.

  3. Step 3

    The report arrives by email.

    A score, finding titles and severity for 14 of the 61 published checks. The proof, the fix and the effort estimate for each finding are in the $149 Site Report.

After a fix, we re-run the same checks. Only a verified retest earns a Fixed & Proven certificate, with a public page anyone can check. A first scan never does: scans prove exposure, retests prove safety.

One payment, no subscription.

Insurers ask because claims are expensive: the median small-business insured claim is about $38K, and the top 2.5% of claims cost more than 7% of revenue [Verizon 2026 Breach Impact Study, checked 2 Nov 2026]. A dated report answers the question before anyone has to file one.

Full pricing and the fix menu

Free Exposure Check

FreeNo card

Where you stand, in plain English, with nothing to buy.

  • Score, finding titles and severity for 14 of 61 checks
  • Passive and single-request checks only
  • Report by email
Run the free check

Site Report

$149One payment

A dated report you can hand your insurer, your customer or your host.

  • Groups A to E and H of the 61 published checks, in a full human-readable report
  • Proof, a fix and an effort estimate for every finding
  • A machine-readable copy for your developer (JSON and SARIF)
  • 1 retest at 30 days
See what Site Report includes

Complete

A year of upkeep included

$749One payment

For shops and sites that take payments or run AI chat.

  • Everything in the Site Report, plus groups F and G of the published checks
  • E-commerce and third-party script audit, exposed endpoints, AI-surface scan
  • 4 retests: at 30, 60 and 90 days, and at 12 months
  • 1 hour of fixing included (findings from your report, in our priority order)
  • Proof Maintenance included through month 12, then $29/mo, cancel anytime (value $279)
See what Complete includes

Proof Maintenance

$279/yr, or $29/mo. Shown as drift watch $19 + proof maintenance $10.

A drift re-scan against your own last scan, a re-issued agent file, and the upkeep that keeps your certificate true. Cancel anytime.

Fixes, priced by effort

$149 to $749 per fix, with the hours capped in writing before we start.

See the fix menu

The guarantee, in three clauses

  1. a

    At least one actionable finding, or it's free.

    If the report gives you nothing you can act on, you get your money back.

  2. b

    Effort estimates you can hold us to.

    Every finding carries an effort estimate. If one marked at 1 hour or less takes more than 2 hours, you get a refund.

  3. c

    A refund revokes the certificate.

    Refunded work can't keep a Fixed & Proven certificate. Its public page changes to REVOKED, so nobody relies on proof you took back.

You can check our work

Find out where you stand.

Free: 14 of 61 checks, with the report sent by email. The rest is one payment, if you want it.

Free. 14 of 61 checks. Next step: the email address the report goes to.