Your first check
Enter an address, read the result and see what to fix first.
Run your first check
On the homepage, enter the address of your website or app, for example your-company.com or customer-portal.lovable.app, and start the check. You don’t need an account. We add the https:// in front ourselves.
Hullwise then loads your homepage once. If it redirects, say to the www address, we follow. Before each hop we make sure it doesn’t lead into an internal network. Next we fetch the JavaScript files the page itself includes from your domain, just as every browser does. While connecting we also read your certificate, and we look up the email protection records in your domain’s public directory (DNS).
This usually takes a few seconds. If your site hasn’t responded after 8 seconds, we stop. The JavaScript files get another 6 seconds.
Read the result
At the top you see a grade from A to F and a score from 0 to 100. How both are calculated is explained in How the grade is calculated.
Below that come the findings, sorted by area. Each one says what can happen and which step fixes it. Address a warning soon. A notice is also worth fixing, but it can wait. Under every finding, a link takes you to the matching section of this help center.
A finding is an indication, not proof. That is why outdated software is marked “possibly affected”. The reason is in Outdated software with known vulnerabilities.
What to fix first
- Exposed keys. An exposed Supabase, OpenAI or Stripe key can be used today. Revoke it with the provider right away and create a new one. The steps are in A key is exposed.
- Encryption. Without HTTPS, anyone on the same network can read along. The grade is then always F. Almost every host provides the certificate for free, see HTTPS and certificates.
- Browser security headers. They bring the most points and often sit in a single file. You’ll find the templates in Setting headers by platform. On Shopify you can’t set them yourself.
- Protection against spoofed email. Two records at your domain provider. Set them up once and you’re done. See Protection against spoofed email.
- Outdated software. The finding disappears after the update. See What you can do.
What comes next
Fix and check again. Enter the same address once more. We don’t keep old results, so you see right away whether your change has gone live.
Check regularly. Your apps change, and new vulnerabilities keep coming to light in existing software. The Business plan checks your domains every week and emails you as soon as a grade gets worse. It costs €149 per month, see Pricing.
Check from the inside with the audit. The check only sees what your app delivers to every visitor. We look at databases, access rules and everything behind the login only in the audit, after you have proven that you own the domain. The audit costs €1,500 once per application. The difference is explained in What we don’t check.
Still have questions? Email us.