Website Security Check | Weak Points Reported with Ways to Fix Them

Disclaimer

We check only the domains you authorize, from the outside

• We check only the public pages of the domain you authorize and its subdomains.
• We only read pages. Our access does not change the content of your website.
• We check only what anyone can observe from the outside.
• We accept orders only from the legitimate administrator of the website.
• We do not check a website when we cannot confirm the authority to order it. Such a check may violate the Act on the Prohibition of Unauthorized Computer Access of Japan.
• An order sent through our contact form is treated as a written authorization.
• If your website is currently compromised or defaced, please contact us before ordering.

This service is not a penetration test. We do not do the following ten things

• Breaking into the website, or changing or deleting data
• Trying passwords by brute force
• Load testing with a large number of requests
• Tricks to avoid detection by your defenses
• Checking pages after login or admin screens
• Entering or sending forms, including test payments
• Observing network traffic when the page runs in a browser
• Checking server internals, databases, cloud permissions, or backups
• Checking hosts outside the authorized scope
• Checking external services themselves, such as CDNs, script providers, and SaaS

We also do not fix the problems we find. Website maintenance is a separate service.

The results do not guarantee that your website is safe

• The results are based on information that can be observed from the outside.
• The check may report a problem that does not exist, and it may miss a problem that does exist.
• Zero findings does not mean that your website is safe.
• The results show the state at the date and time of the check.
• Changes to the website after the check are not included.
• Vulnerabilities published after the check are not included.
• Items that cannot be confirmed from the outside are listed in the report as items for you to confirm. We never mark them as safe.
• The record of current scripts uses the state at the time of the check as the baseline. If a script had already been altered at that time, we cannot tell.

We are not responsible for the results of changes made based on the report

• The changes are made by you, or by the developer or server administrator you hire.
• We check only what is visible from the outside. We cannot see the settings and programs inside your server.
• The same change can have different results depending on the server settings and programs.
• The configuration examples in the report are for reference only.
• Please test the configuration examples in a test environment before applying them to your live server.
• Depending on how your website is built, a configuration example may stop some pages or features from working.
• Whether to apply a configuration example is your decision.

Our access is spaced three seconds apart, with up to 400 requests per check

• We wait three seconds between requests.
• We do not send multiple requests at the same time.
• One check sends up to 400 requests.
• Our requests carry a name that shows they are for the check. You can identify them in your server logs.
• Your WAF (web application firewall) may block our requests.
• Your WAF or monitoring system may raise alerts.
• If you use a rental server, please confirm that its terms allow external checks.
• If another company runs your server or WAF, please tell that company the date and time of the check in advance.

We keep the records of the check for three years

• We keep the results and the report for three years.
• We delete records after that period.
• We do not keep the contents of exposed files, cookie values, or login names in the records or the report.

Communication and schedule

• We work on Japan Standard Time (JST).
• When requesting a meeting, please specify the date and time in JST.
• Prices are in Japanese yen (JPY).