Hey Product Hunt 👋 I built a website security scanner. Then I pointed it at my own domain and found it had no SPF record — while I was publishing a guide on email authentication. That's roughly the whole reason this exists: everyone scans the thing they're worried about, and nobody scans the thing they assume is fine. Webcuris reads what your site gives away to anyone who visits it — security headers, TLS configuration, DNS records, cookies, exposed subdomains, outdated dependencies — and tells you exactly how to fix each one. Not "add a CSP header," but the actual line for your Nginx, Apache, Caddy or Cloudflare setup. Try it with no account: webcuris.com/scan — 10 checks, results on the page, nothing stored. Two things that make it odd: 🔍 Every finding carries a confidence level. Confirmed, strong indication, potential, or informational. A pattern in your code isn't proof of a bug, and I'd rather say so than inflate a number. 🚫 I publish the list of checks it refuses to run. Credential stuffing, SQL injection with live payloads, request smuggling — all buildable, all excluded, because proving the finding means damaging someone. It makes my feature list shorter than competitors'. I think that's the honest trade. It also tracks whether last month's fix actually held, which turns out to be the part people keep. What it isn't: no SOC 2, no third-party pentest, no malware removal. It finds and explains — it doesn't clean up. Ask: scan your own site and tell me what it got wrong. False positives are the fastest way to make this better, and I'd rather hear them here than not hear them.

Webcuris

Webcuris is a continuous security assessment platform

Webcuris is a continuous security assessment platform