Security scanningCatch the gaps before an auditor does.
A security scan inspects one site you have verified for common misconfigurations and exposed files, then grades it A to F with a report you can hand to a reviewer.
100 scans a month on Pro. 500 on Business.
88
score out of 100
24
checks passing
No high-severity findings. From the sample report.
The highlights.
Security reviews and customer questionnaires ask the same things. Are the right headers set? Is HTTPS enforced? Is anything exposed that should not be? Checking by hand takes hours, and a screenshot proves little.
Four steps. From proof to PDF.
Verify the asset
Every scan runs against a domain you've proven you own. No scanning systems you don't control.
Scan the surface
We check security headers, HTTPS enforcement, cookies, exposed files, and email and DNS records, from the home page and a fixed list of paths.
Grade the result
Each check that fails takes points off by its severity, and the score becomes a single A-to-F grade.
Hand it over
Export a branded PDF with every issue explained in words a non-specialist can follow.
A grade, the findings, and what to do about each.
The report lists every check by category, with a severity on each one that did not pass. A grade is not pass or fail: a B with no high-severity findings means solid fundamentals with a few hardening items left.
Security assessment
Sample reportExample site
Overall grade
88 / 100
High
0
To fix
3
Passing
24
AI summary
Solid fundamentals: 88 out of 100, no high-severity issues, 24 checks passing. The three items holding it back from an A are hardening, not holes. Tightening the Content-Security-Policy closes the main cross-site-scripting gap; the two missing cross-origin headers (COOP and CORP) add cross-origin isolation.
What to fix first
- Content-Security-Policy allows unsafe-inline and unsafe-evalhardening
- Cross-Origin-Opener-Policy header is missinghardening
- Cross-Origin-Resource-Policy header is missinghardening
An automated assessment, not a penetration test.
Branded, downloadable, shareable: the PDF carries the same page, ready for a review or a vendor questionnaire.
View the full sample report (PDF)What a scan looks at.
Headers and HTTPS
What the browser is told to enforce.
The scan reads your security response headers and checks that HTTPS is enforced, then says which gaps matter and which are hardening.
- Strict-Transport-Securityset
- Content-Security-Policyallows unsafe-inline
- Cross-Origin-Opener-Policymissing
- Cross-Origin-Resource-Policymissing
Exposure
What the site gives away.
It probes for files that should not be public and for software details a site discloses about itself. It reads only what is publicly observable.
- Exposed-file probesfiles that should stay private
- Technology disclosureversions a site reveals
- Cookieshow they are protected
Email and DNS
Who may speak for your domain.
The same scan checks the records that stop others sending mail as you or issuing certificates for your name.
- SPF · DKIM · DMARCwho may send your mail
- CAAwho may issue certificates
- DNSSECwhether DNS answers are signed
What the report counts.
Four figures from the sample scan, and why each one matters.
B
Overall grade
A single A-to-F roll-up of every check: each one that fails takes points off by its severity. The one figure an auditor or customer questionnaire wants to see first.
0
High severity
Count of failing checks at the highest of the three severities. Zero here means nothing urgent — what's left is hardening, not emergency fixes.
24
Checks passing
How many of the security checks the site already clears — headers, HTTPS enforcement, exposed-file probes, email/DNS records, and more.
30+
Checks run
The breadth of the passive assessment: security headers, HTTPS enforcement, information disclosure, cookies, exposed files, and email and DNS records, each one explained.
What you get.
- Up to 100 security scans every month on Pro
- Security headers, HTTPS enforcement, exposed files, and email and DNS records
- A single A-to-F grade, with every finding explained
- A BCDRPulse-branded PDF for a security review or a vendor questionnaire
- Honestly labelled an automated assessment — not a penetration test
- See all features ›
Is it the right tool?
A strong fit when
- A customer or an auditor has sent you a security questionnaire.
- You changed your headers, HTTPS set-up or hosting and want to confirm nothing slipped.
- You look after several sites and need the same evidence for each.
Not the best fit when
- You need a penetration test: a person trying to break in. We do not offer one.
- You need testing behind a login. The scan does not log in.
- You want to scan a site you do not control. Only verified sites can be scanned.
The scan is passive and read-only. It inspects what is publicly observable and changes nothing on your site.
Included in Pro and Business.
Pro
100 security scans a month, 25 sites
$49 a month₹4,799 a month in India
Business
500 security scans a month, 100 sites
$199 a month₹19,499 a month in India
In more detail.
What a security scan actually checks
A BCDRPulse security scan is a passive, read-only inspection of one domain you have verified you own. It looks at the things that most often let a site down in a security review — security response headers, HTTPS enforcement, cookies, exposed files and common misconfigurations, and email and DNS records — and rolls everything into a single grade. It is honest about its own scope: it reads the home page and a fixed list of paths, it inspects only what is publicly observable, it does not log in, and it changes nothing on your site.
How the grade works
The score starts at 100, and each check that fails or warns takes off 15, 8 or 4 points by its severity (high, medium or low). The score becomes one A-to-F grade — a quick, shareable summary of where you stand. A grade is not pass/fail: a B with no high-severity findings means solid fundamentals with a few hardening items left, not open holes. The point is to show you where you stand, and each check that did not pass says what to change.
What's in the report
The report is a downloadable, branded PDF: the overall grade, every check with its result, a severity on each one that did not pass, and an AI summary of the top priorities — useful supporting evidence for a security review or a customer's security questionnaire. Example result: a grade of B at 88/100 with no high-severity findings and 24 checks passing; the items holding it back from an A were hardening, not holes — for instance a Content-Security-Policy still allowing unsafe-inline, and a couple of missing cross-origin headers.
What a security scan is not
A security scan is an automated assessment, and we label it plainly as one — it is not a penetration test. It inspects publicly observable headers and configuration; it does not exploit anything or test your application's logic. A penetration test is a separate, human-led engagement. BCDRPulse does not offer one.
Questions people ask first.
Is this a penetration test?
No — and we label it plainly as an automated assessment. It inspects publicly observable security headers and configurations. It does not exploit anything or test application logic. A penetration test is a separate, human-led engagement. BCDRPulse does not offer one.
Can I use this report for a security review?
It's a branded, downloadable PDF with every finding explained — useful supporting evidence for a security review or a customer's security questionnaire. It's evidence of your current posture, not a formal certification.
Does a 'B' grade mean my site is insecure?
Not at all. A B with no high-severity findings means solid fundamentals with a few hardening items left — the kind of thing you close to reach an A, not urgent holes.
How many scans can I run?
Up to 100 every month on the Pro plan, against any of your verified assets. The limit resets at the start of each calendar month.
What's the difference between a security scan and deep TLS analysis?
The security scan confirms the broad basics — that HTTPS is enforced, your security headers are set, and there are no obvious misconfigurations. Deep TLS analysis goes much further on one of those areas: the certificate and its chain of trust, the protocol versions on offer, weak cipher suites, and a battery of TLS-specific checks, graded on their own.
How often should I run a security scan?
Whenever you change your site, your headers, or your HTTPS set-up — and again from time to time, because a grade drifts as configuration changes. A scan is started by hand; there is no schedule. Many people run one before a security review or a new customer's questionnaire.
My site scored a B (or lower) — what should I fix first?
Start with anything marked high, then medium: each check that did not pass says what to change, and the AI summary names the top three priorities in order of risk. After that, the hardening items (things like a stricter Content-Security-Policy or missing cross-origin headers) are what move a good grade to an excellent one.
Know your grade before someone asks.
Signing up is free and starts uptime monitoring for 10 sites. Running security scanning needs the Pro plan or Business.
- Grade B, 88 out of 100 and 24 checks passing are the figures in the sample report, not a customer's site.
- Allowances are per calendar month and can be used on any of your verified sites.
- Introductory prices, before GST or VAT. Regular prices are $99 and $399 a month (₹9,699 and ₹38,999 in India).