Security powered by frontier AI

Defend against attackers with superintelligence.

Hardn uses the best frontier AI models to protect you from attackers. It scans the websites, apps and APIs you own for the weaknesses they look for, grades them A to F, and writes the exact steps to fix each one. You prove you own a site before Hardn touches it.

Start free See how a scan works

Your first scan is free when you sign up. No card needed.

27 checks in seven groups

TLS & certificate3 checks
Security headers7 checks
Cookies1 check
Page content6 checks
Exposed files5 checks
DNS & email3 checks
Access controlCORS + deep scan

Who it's for

Scan what you run in a few minutes

Pick the site you worry about most. Add it, prove it's yours, and you'll have a grade and a fix list before your coffee's cold.

How it works

Your address in, a graded fix list out

You start a scan. Hardn checks you still own the site, locks the scan to it, runs 27 read-only checks, holds every finding to its evidence, grades the result and writes the fixes: the same six stages for every scan.

Started from

Dashboard · REST API · Schedule

Your site

“shop.example.com”

Context

Proof: DNS TXT or a file
Paths you excluded
Test accounts (deep scan)

HARDN

Ownership

Preflight

Your DNS TXT record or verification file is checked again, right before the scan. No proof, no scan.

_hardn-challenge · /.well-known

Scope lock

Guard

Only the host you verified and its www twin. Private, loopback and metadata addresses are refused.

Excluded paths skipped

Scan

27 checks

Read-only checks of TLS, headers, cookies, page content, exposed files, DNS & email and CORS.

GET · HEAD · OPTIONS · ≤ 5/s

Evidence

Validate

Each finding is held to written criteria. Anything that doesn't hold up is rejected; secrets are masked.

written criteria per finding

Grade

A–F

A score out of 100 and a grade from A to F, compared with your last scan of the same site.

any critical caps the grade at D

Fix report

Claude

Plain-English steps for every issue, written for what your site runs on. Hand it to your developer.

HTML · share link · JSON

Report

Done · 1 credit

Grade B, 83 out of 100. Fix first: the session cookie is sent without the Secure flag [1]. Then add a Content-Security-Policy header [2].

1Cookie · Set-Cookie: session
2Header · content-security-policy

27 checks · 21 passed · 4 failed · 2 skipped · share link ready

Started from

Dashboard · REST API · Schedule

Your site

“shop.example.com”

Context

Proof: DNS TXT or a file
Paths you excluded
Test accounts (deep scan)

https only

HARDN

Ownership

Preflight

Your DNS TXT record or verification file is checked again, right before the scan. No proof, no scan.

_hardn-challenge · /.well-known

verified

Scope lock

Guard

Only the host you verified and its www twin. Private, loopback and metadata addresses are refused.

Excluded paths skipped

in scope

Scan

27 checks

Read-only checks of TLS, headers, cookies, page content, exposed files, DNS & email and CORS.

GET · HEAD · OPTIONS · ≤ 5/s

findings

Evidence

Validate

Each finding is held to written criteria. Anything that doesn't hold up is rejected; secrets are masked.

written criteria per finding

evidence

Grade

A–F

A score out of 100 and a grade from A to F, compared with your last scan of the same site.

any critical caps the grade at D

score

Fix report

Claude

Plain-English steps for every issue, written for what your site runs on. Hand it to your developer.

HTML · share link · JSON

re-checked before every scheduled scan
rescan · fixed issues close
≤ 2,000 requests · ≤ 20 minutes · scanned from AWS US East

report

Report

Done · 1 credit

Grade B, 83 out of 100. Fix first: the session cookie is sent without the Secure flag [1]. Then add a Content-Security-Policy header [2].

1Cookie · Set-Cookie: session
2Header · content-security-policy

27 checks · 21 passed · 4 failed · 2 skipped · share link ready

What you get

A grade, every issue, and how to fix it

No raw scanner dump. Each issue comes with the evidence Hardn saw, why it matters and the change to make. Rescan to see it fixed, schedule scans to keep it that way, and share the report with your developer or your client.

Scan your site free

hardn.si/sites/new

HARDNDashboardSitesScansIssuesAPI keysNotificationsBilling

Add a site

Prove you own shop.example.com. Hardn won't contact it until you do.

✓Address
2Prove ownership
3First scan

Add a DNS recordVerified

TypeTXTCopy

Name_hardn-challenge.shop.example.comCopy

Valuehardn_verify_9c41d27e08b3a6f5Copy

Or upload a file

https://shop.example.com/.well-known/hardn-verify.txt

Start the first scanChecked 12 seconds ago

hardn.si/scans/asm_6c1f0e29b7d4

HARDNDashboardSitesScansIssuesAPI keysNotificationsBilling

Scan of shop.example.com

Public scan · started by hand · 38 s

Stop

Running read-only checks64%

21 requests so far · at most 5 a second · scanned from US East

Checks6 of 27

Certificate and chainPassed
Legacy TLS versionsPassed
HTTP to HTTPS redirectPassed
Strict-Transport-SecurityPassed
Content-Security-PolicyFailed
Cookie flagsFailed
Outdated JavaScript librariesChecking…
Sensitive files (.git, .env, backups)Queued
SPF and DMARCQueued

hardn.si/scans/asm_6c1f0e29b7d4

HARDNDashboardSitesScansIssuesAPI keysNotificationsBilling

Scan of shop.example.com

Completed · public scan · 1 min 4 s

Share report

Grade B

Good. A few things worth tidying.

2 new · 3 fixed since last scan

High 1Medium 1Low 2Info 3

Session cookie sent without the Secure flagHigh

Evidence: Set-Cookie: session=•••; Path=/; HttpOnly

Fix report

Set the Secure flag on the session cookie so it is only sent over HTTPS.
In Next.js, pass it where the cookie is created:

cookies().set("session", id, { secure: true, httpOnly: true, sameSite: "lax" })

No Content-Security-Policy headerMedium

hardn.si/api-keys

HARDNDashboardSitesScansIssuesAPI keysNotificationsBilling

API keys

Start scans and read reports from your pipeline.

Create key

NameKeyLast used

GitHub Actionshk_live_3fa9…4 min ago

Release checkshk_live_b81c…Yesterday

Start a scan from CI

# one POST starts a scan of a verified site
curl -X POST https://api.hardn.si/v1/scans \
  -H "Authorization: Bearer $HARDN_KEY" \
  -d '{"target_id": "tgt_51d8…", "scan_type": "public"}'

# → 201 { "id": "asm_6c1f…", "status": "queued" }

Ownership

DNS TXT record or a file
Checked again before every scan
Verified

Learn more

What we check

The problems behind real breaches, checked every scan

Seven groups, each looking for something that's easy to miss and easy to fix once you know about it.

TLS & certificates
Your certificate, protocols and HTTPS setup.
- Certificate validity, chain and expiry
- Legacy protocol versions (TLS 1.0/1.1)
- HTTP to HTTPS redirect
Security headers
The headers that stop whole classes of attack.
- Strict-Transport-Security strength
- Content-Security-Policy quality
- Clickjacking protection
- MIME sniffing, referrer and permissions policies
- Server and framework version disclosure
Cookies & sessions
How your site protects its cookies.
- Secure flag on cookies served over HTTPS
- HttpOnly and SameSite on session cookies
Page content
What your pages load and what they give away.
- Mixed content on HTTPS pages
- Third-party scripts without integrity checks
- Outdated JavaScript libraries with known flaws
- Secrets and API keys in JavaScript bundles
- Exposed source maps
- CMS version disclosure
Exposed files & data
Things that should never be public.
- Exposed .git, .env and backup files
- Directory listings
- Verbose error pages and stack traces
- robots.txt pointing at sensitive paths
- A security.txt for researchers
DNS & email
Whether someone can send email as you, and who may issue your certificates.
- SPF and DMARC policy
- CAA records
- DNSSEC
Access control
Cross-site access rules, and with a deep scan, whether accounts stay apart.
- Permissive CORS (credentials allowed from any origin)
- Data reachable without signing in (deep scan)
- One customer reading another's data (deep scan)
Coming next
Sign-in flows for deep scans
Today a deep scan uses tokens or cookies from your test accounts. Signing in with a username and password is next.
Read the help centre

Built for real sites

Findings you can trust, not a wall of noise

A scanner is only useful if you believe it. Every finding is held to written criteria, carries its evidence, and is tracked across scans so you see what's new and what's fixed.

Evidence on every finding
The exact header, file or record Hardn saw, with secrets masked, so you can check it yourself.
Validated, not guessed
Each finding type has written criteria. Anything that doesn't meet them is rejected, not reported.
A grade you can track
A score out of 100 and a grade from A to F, compared with your last scan of the same site.
Issues across scans
An issue stays one issue from scan to scan: new, fixed, or accepted as a risk with your note.

Safe by design

Safe to point at your production site

Hardn reads, it never changes anything, and it only ever reads sites whose owners proved they own them. No badges, just the mechanisms.

Ownership first
- A DNS TXT record or a file on the site, before the first scan
- Checked again right before every scan
- Lose the proof and scheduled scans pause
Read-only and gentle
- GET, HEAD and OPTIONS requests only, never a form
- At most 5 requests a second, 2,000 requests, 20 minutes
- Links that could change data are skipped
Scope-locked
- Only the host you verified and its www twin
- Private, loopback and cloud metadata addresses refused
- Paths you exclude are never requested

Scanners on AWS US East. Your data encrypted on AWS and Supabase.

Security in detail

Get started

From sign-up to your first report in four steps

01
Create your account
Email and password, or Google or Microsoft. Your first scan is free.
02
Add your site
The address of a website, web app or API you run. Add more any time.
03
Prove you own it
One DNS TXT record or one small file. Hardn checks it before every scan.
04
Read the report
A grade, every issue with its evidence, and the steps to fix each one.

Start free How verification works

Your first scan is free, no card needed. You prove you own the site before Hardn touches it.

Pricing

Start free, pay when it's worth it

Pricing in previewPlans may change before launch. Prices in Australian dollars, including GST. Today, scans are paid with credits; your first 3 are free.

Compare plans

1 site
Free
See where you stand.
A$0 forever
- One public scan
- Grade A–F and every issue found
- Fix steps locked
Start free
1 site
Solo
For a founder or freelancer with one site.
A$29 per month
- Public scans
- Fix report for every issue
- Weekly rescans
- Downloadable report
Choose Solo
Most teams
Pro
For a product team shipping every week.
A$99 per month
3 sites
- Everything in Solo
- Deep scans with your test accounts
- Scheduled scans
- REST API for CI
Choose Pro
20 sites
Agency
For agencies and MSPs looking after clients.
A$299 per month
- Everything in Pro
- Client organisations, one per client
- Move credits between clients
- White-label reports
Choose Agency

For your engineers

One POST starts a scan, the findings come back as JSON

Register a site, verify it, start scans and pull findings and the report from your pipeline. API keys are scoped to one organisation and the same ownership rules apply.

Read the REST API docs

# start a public scan of a verified site
curl -X POST https://api.hardn.si/v1/scans \
  -H "Authorization: Bearer $HARDN_KEY" \
  -d '{"target_id": "tgt_…", "scan_type": "public"}'

# then read the findings
curl https://api.hardn.si/v1/scans/asm_…/findings \
  -H "Authorization: Bearer $HARDN_KEY"

FAQ

Questions people ask before their first scan

Something else? The help centre goes deeper.

Is it safe to scan my live site?

Yes. Hardn only reads, the way a careful visitor would, and it limits how fast and how much it requests. It never submits forms, logs in with guessed passwords or sends attack payloads.

Why do I have to prove I own the site?

So nobody can use Hardn to probe someone else's site. You add one DNS TXT record or upload one small file; it takes about a minute, and Hardn checks it again before every scan.

What's in the fix report?

For each problem: what it is in plain English, why it matters and the change to make, written for what your site runs on (for example Next.js on Vercel, WordPress or nginx). Hand it straight to your developer.

How is this different from a penetration test?

A human penetration test goes deep, once, and costs thousands. Hardn checks the problems behind many real breaches as often as you like and shows when each one is fixed. It isn't a substitute for a manual test, and many teams use both.

Can I scan behind a login?

Yes, with a deep scan. Add your own test accounts and Hardn checks that each one only sees its own data, and that nothing private can be read without signing in.

Can I run it from CI?

Yes. Create an API key, then start scans and read reports from your pipeline with the REST API. See the developer docs.

Where is my data kept?

The scanners run on AWS in US East. Your account and scan data are stored encrypted on AWS and Supabase. Test-account secrets are encrypted, and evidence is stored with secrets masked. The privacy policy lists every provider and location.

Find what attackers find. Then fix it.

Add your site, prove you own it, and Hardn runs 27 read-only checks. You get a grade, every issue it found and the steps to fix each one. Your first scan is free.

Start free How we scan safely

Defend against attackers with superintelligence.

Scan what you run in a few minutes

Your address in, a graded fix list out

A grade, every issue, and how to fix it

The problems behind real breaches, checked every scan

TLS & certificates

Security headers

Cookies & sessions

Page content

Exposed files & data

DNS & email

Access control

Findings you can trust, not a wall of noise

Evidence on every finding

Validated, not guessed

A grade you can track

Issues across scans

Safe to point at your production site

Ownership first

Read-only and gentle

Scope-locked

From sign-up to your first report in four steps

Create your account

Add your site

Prove you own it

Read the report

Start free, pay when it's worth it

Free

Solo

Pro

Agency

One POST starts a scan, the findings come back as JSON

Questions people ask before their first scan

Find what attackers find. Then fix it.