Skip to content
Hardn

Security powered by frontier AI

Defend against attackers with superintelligence.

Hardn scans the websites, apps, APIs and code repositories you own for the weaknesses attackers look for, grades them A to F, and writes the exact steps to fix each one. You prove you own a site, or connect your code through GitHub, before Hardn touches it.

Start freeSee a sample report

Your first scan is free when you sign up. No card needed.

Scan of shop.example.com
Completed
C

Grade C 71 out of 100

Fair. Some problems an attacker could use.

1 new, 3 fixed since last scan. 23 checks, 18 passed.

What to fix first

Most severe first

  1. 1HighSession cookie sent without the Secure flagcookies().set("session", id, { secure: true, httpOnly: true, sameSite: "lax" })
  2. 2MediumNo Content-Security-Policy headerContent-Security-Policy: default-src 'self'; object-src 'none'; frame-ancestors 'none'
  3. 3MediumjQuery 1.12.4 has known vulnerabilitiesnpm install jquery@3 (or the 3.7.1 CDN tag with integrity=)
Sample, not live data.See the full sample report
An example report, not real data.
“Is my site safe, and what do I fix first?”
A grade from A to F and the one thing to do next, in plain words. No security team needed.
“Just give me the fix.”
Every finding carries its evidence and the exact change, written for what your site runs on. Copy it and go.
“Can I show a client we did our homework?”
A report you can share or export, a score that moves scan by scan, and each client in its own organisation.

27 checks in seven groups

  • TLS & certificate3 checks
  • Security headers7 checks
  • Cookies1 check
  • Page content6 checks
  • Exposed files5 checks
  • DNS & email3 checks
  • Access controlCORS + deep scan

What you can do

Everything you ship, checked from one account

Pick where to start. You'll create a free account and go straight to that task.

  • Websites

    Scan a site you own: TLS, headers, cookies, exposed files, DNS and email. A grade from A to F and a fix for every issue.

  • Web apps with sign-in

    Deep scans use your own test accounts to check that each customer sees only their own data, and that nothing private loads without signing in.

  • APIs

    Add a REST API and attach its OpenAPI spec. Hardn checks TLS, CORS and headers, and on a deep scan which endpoints answer without a token.

  • Repositories

    Connect GitHub, pick a repository and a Claude agent. Committed secrets, vulnerable dependencies and flaws in your code, each with a fix.

  • Supply chain

    Upload a lockfile to check every dependency against the public OSV database, and your config files for secrets and IaC mistakes.

  • Runtime protection

    Add Hardn's middleware to your app to label AI agents and bots, plant honeytokens and screen prompts for injection.

  • AI features

    Test your chatbot or LLM endpoint for prompt injection and leaked secrets, with harmless probes you approve. Start with the site it runs on.

  • CI and the CLI

    Create an API key and run Hardn's CLI in your pipeline. The build fails when a high or critical issue appears.

Who it's for

Scan what you run in a few minutes

Pick the site you worry about most. Add it, prove it's yours, and you'll have a grade and a fix list before your coffee's cold.

How it works

Your address in, a graded fix list out

You start a scan. Hardn checks you still own the site, locks the scan to it, runs 27 read-only checks, holds every finding to its evidence, grades the result and writes the fixes: the same six stages for every scan.

How a Hardn scan runs. A scan starts from the dashboard, the REST API or a schedule, for a site you added. 1: Hardn checks your proof of ownership, a DNS TXT record or a file on the site, again right before the scan; without it nothing is contacted. 2: the scan is locked to the verified host and its www twin; private, loopback and cloud metadata addresses are blocked and paths you excluded are skipped. 3: 27 read-only checks run with GET, HEAD and OPTIONS requests only, at most 5 requests a second, 2,000 requests and 20 minutes. 4: each finding's evidence is checked against written criteria and secrets are masked. 5: the scan is graded A to F and compared with your last scan, so new and fixed issues show up. 6: Claude writes plain-English fix steps for each issue. You get the report, a share link and the JSON.

What you get

A grade, every issue, and how to fix it

No raw scanner dump. Each issue comes with the evidence Hardn saw, why it matters and the change to make. Rescan to see it fixed, schedule scans to keep it that way, and share the report with your developer or your client.

Scan your site free
hardn.si/sites/new

Add a site

Prove you own shop.example.com. Hardn won't contact it until you do.

  1. ✓Address
  2. 2Prove ownership
  3. 3First scan
Add a DNS recordVerified
TypeTXTCopy
Name_hardn-challenge.shop.example.comCopy
Valuehardn_verify_9c41d27e08b3a6f5Copy
Or upload a file

https://shop.example.com/.well-known/hardn-verify.txt

Start the first scanChecked 12 seconds ago
The Add site page on its ownership step: a DNS TXT record to copy, a file you can upload instead, and the site marked verified.
Learn more about prove you own it
Learn more about scan it, read-only
Learn more about fix what matters first
Learn more about watch it stay fixed
Learn more about run it from CI

What we check

The problems behind real breaches, checked every scan

Seven groups, each looking for something that's easy to miss and easy to fix once you know about it.

  • TLS & certificates

    Your certificate, protocols and HTTPS setup.

    • Certificate validity, chain and expiry
    • Legacy protocol versions (TLS 1.0/1.1)
    • HTTP to HTTPS redirect

  • Security headers

    The headers that stop whole classes of attack.

    • Strict-Transport-Security strength
    • Content-Security-Policy quality
    • Clickjacking protection
    • MIME sniffing, referrer and permissions policies
    • Server and framework version disclosure

  • Cookies & sessions

    How your site protects its cookies.

    • Secure flag on cookies served over HTTPS
    • HttpOnly and SameSite on session cookies

  • Page content

    What your pages load and what they give away.

    • Mixed content on HTTPS pages
    • Third-party scripts without integrity checks
    • Outdated JavaScript libraries with known flaws
    • Secrets and API keys in JavaScript bundles
    • Exposed source maps
    • CMS version disclosure

  • Exposed files & data

    Things that should never be public.

    • Exposed .git, .env and backup files
    • Directory listings
    • Verbose error pages and stack traces
    • robots.txt pointing at sensitive paths
    • A security.txt for researchers

  • DNS & email

    Whether someone can send email as you, and who may issue your certificates.

    • SPF and DMARC policy
    • CAA records
    • DNSSEC

  • Access control

    Cross-site access rules, and with a deep scan, whether accounts stay apart.

    • Permissive CORS (credentials allowed from any origin)
    • Data reachable without signing in (deep scan)
    • One customer reading another's data (deep scan)

  • Coming next

    Sign-in flows for deep scans

    Today a deep scan uses tokens or cookies from your test accounts. Signing in with a username and password is next.

    Read the help centre

Built for real sites

Findings you can trust, not a wall of noise

A scanner is only useful if you believe it. Every finding is held to written criteria, carries its evidence, and is tracked across scans so you see what's new and what's fixed.

  • Evidence on every finding

    The exact header, file or record Hardn saw, with secrets masked, so you can check it yourself.

  • Validated, not guessed

    Each finding type has written criteria. Anything that doesn't meet them is rejected, not reported.

  • A grade you can track

    A score out of 100 and a grade from A to F, compared with your last scan of the same site.

  • Issues across scans

    An issue stays one issue from scan to scan: new, fixed, or accepted as a risk with your note.

Safe by design

Safe to point at your production site

Hardn reads, it never changes anything, and it only ever reads sites whose owners proved they own them. No badges, just the mechanisms.

  • Ownership first

    • A DNS TXT record or a file on the site, before the first scan
    • Checked again right before every scan
    • Lose the proof and scheduled scans pause

  • Read-only and gentle

    • GET, HEAD and OPTIONS requests only, never a form
    • At most 5 requests a second, 2,000 requests, 20 minutes
    • Links that could change data are skipped

  • Scope-locked

    • Only the host you verified and its www twin
    • Private, loopback and cloud metadata addresses refused
    • Paths you exclude are never requested

Scanners on AWS US East. Your data encrypted on AWS and Supabase.

Security in detail

Get started

From sign-up to your first report in four steps

  1. 01

    Create your account

    Email and password, or Google or Microsoft. Your first scan is free.

  2. 02

    Add your site or code

    The address of a website, web app or API you run, or a repository through GitHub. Add more any time.

  3. 03

    Prove you own it

    One DNS TXT record or one small file for a site; for code, connecting GitHub is the proof. Hardn checks again before every scan.

  4. 04

    Read the report

    A grade, every issue with its evidence, and the steps to fix each one.

Start freeHow verification works

Your first scan is free, no card needed. You prove you own the site before Hardn touches it.

Pricing

Start free, pay when it's worth it

Prices in Australian dollars, including GST.

Compare plans

  • 1 site

    Free

    See where you stand.

    A$0 forever

    No card needed

    • 1 site and 1 public repository you own
    • One scan a month
    • Grade A–F and every issue found
    • Fix steps locked
    Start free

  • 1 site

    Solo

    For a founder or freelancer with one site.

    A$29 per month

    or A$290 a year, 2 months free

    • 1 site and 3 repositories
    • Scans included, weekly rescans
    • Fix report for every issue
    • 5 AI review credits a month
    Choose Solo

  • Most teams

    Pro

    For a product team shipping every week.

    A$99 per month

    or A$990 a year, 2 months free

    3 sites

    • 3 sites and 10 repositories
    • Daily rescans and deep scans with test accounts
    • CI and REST API: 500 runs a month
    • 20 AI review credits a month
    Choose Pro

  • 20 sites

    Agency

    For agencies and MSPs looking after clients.

    A$299 per month

    or A$2,990 a year, 2 months free

    • 20 sites and 50 repositories
    • Everything in Pro, 3,000 CI runs a month
    • 60 AI review credits a month
    • Client organisations and white-label reports
    Choose Agency

For your engineers

One POST starts a scan, the findings come back as JSON

Register a site, verify it, start scans and pull findings and the report from your pipeline. API keys are scoped to one organisation and the same ownership rules apply.

Read the REST API docs
# start a public scan of a verified site
curl -X POST https://api.hardn.si/v1/scans \
  -H "Authorization: Bearer $HARDN_KEY" \
  -d '{"target_id": "tgt_…", "scan_type": "public"}'

# then read the findings
curl https://api.hardn.si/v1/scans/asm_…/findings \
  -H "Authorization: Bearer $HARDN_KEY"

FAQ

Questions people ask before their first scan

Something else? The help centre goes deeper.

Is it safe to scan my live site?
Yes. Hardn only reads, the way a careful visitor would, and it limits how fast and how much it requests. It never submits forms, logs in with guessed passwords or sends attack payloads.
Why do I have to prove I own the site?
So nobody can use Hardn to probe someone else's site. You add one DNS TXT record or upload one small file; it takes about a minute, and Hardn checks it again before every scan.
What's in the fix report?
For each problem: what it is in plain English, why it matters and the change to make, written for what your site runs on (for example Next.js on Vercel, WordPress or nginx). Hand it straight to your developer.
How is this different from a penetration test?
A human penetration test goes deep, once, and costs thousands. Hardn checks the problems behind many real breaches as often as you like and shows when each one is fixed. It isn't a substitute for a manual test, and many teams use both.
Can I scan behind a login?
Yes, with a deep scan. Add your own test accounts and Hardn checks that each one only sees its own data, and that nothing private can be read without signing in.
Can Hardn review my code?
Yes. Connect GitHub and choose the repositories Hardn may read; it only ever reads them, never writes. Pick an agent for each review: Baseline checks dependencies, committed secrets and CI or infrastructure config, and the Claude agents also read your code for flaws like injection and broken access control. You see the price before it runs.
Can I run it from CI?
Yes. Create an API key, then start scans and read reports from your pipeline with the REST API. See the developer docs.
Where is my data kept?
The scanners run on AWS in US East. Your account and scan data are stored encrypted on AWS and Supabase. Test-account secrets are encrypted, and evidence is stored with secrets masked. The privacy policy lists every provider and location.

Find what attackers find. Then fix it.

Add your site, prove you own it, and Hardn runs 27 read-only checks. You get a grade, every issue it found and the steps to fix each one. Your first scan is free.

Start freeHow we scan safely