Questions, answered plainly.

The free Exposure Check costs nothing. It runs 14 of 61 checks and emails you a score, finding titles and severity.

The full Site Report is $149, one payment: every finding with proof, a fix and an effort estimate, plus one retest at 30 days. Complete is $749, one payment, and adds the e-commerce, endpoint and AI-surface checks, four retests, an hour of fixing and a year of Proof Maintenance.

If you want us to do the fixes, each one is priced by effort, from $149 to $749. Proof Maintenance after the first year is $29/mo or $279/yr. There is no subscription unless you choose one.

It runs 14 of 61 checks, all passive or single-request, every one marked on the published list: your SPF and DMARC records, your certificate, HSTS, your redirect chain, mixed content, your content security policy and cookie flags, and a light crawl of about 12 pages for exposed emails, .git/.env/backup files and third-party scripts, plus whether AI agent endpoints are exposed.

You get a score and the title and severity of each finding. The proof and the fix are in the paid report.

It is issued only after a retest shows a fix worked, never from a first scan. It carries a certificate ID, your domain, the before and after scan IDs, the check-set version, dates, and a public verification page.

Its state is public: PROVEN, EXPIRED when the drift window passes, or REVOKED if the work was refunded. Proof Maintenance is what keeps it current.

Yes, on the terms of the guarantee. If the report has no actionable finding, it's free. If a fix we estimated at 1 hour or less takes more than 2 hours, you get a refund.

A refund revokes any certificate tied to that work, and its public page says so.

We never run a paid scan before you prove you control the site, with a DNS TXT record or a file at /.well-known. We never run aggressive tests (fingerprinting, path brute force, login attempts) without your per-asset opt-in. We never take over a subdomain to prove a point; we report the risk.

We never put you on a marketing list unless you tick that box, and the box starts unticked. Free-check emails are about your report and your domain, nothing else. We never sell your data, and we never use a report to cold-pitch you.

No. Reports are one-time payments. Proof Maintenance is the only recurring item; it is optional and you can cancel it anytime. On Complete, the first year is included and the price after month 12 is printed before you buy.

The free check sends single requests and reads public DNS. Paid scans use the Safe Profile by default: low rate, no flooding, nothing aggressive without your opt-in, and we stop within 4 hours of your request. Our scanner names itself on the scanner identity page.

Utlyze's security practice. Questions about a scan go to scan@utlyze.com; anything that looks like abuse goes to abuse@utlyze.com.