Home  ›  Pricing  ›  Deep Scan
Deep Scan audit

The full scan, without the human layer.

Everything in Essentials, plus the 16 deeper security scans Essentials doesn't run — the checks an attacker actually runs against your site. All 52 checks, every issue named in plain English. What it doesn't include is a person: no professional review, and no prioritised remediation roadmap.

$149
One-off · AUD · report within 2 hours · no subscription
Get Deep Scan — $149 See a sample report
52 checks · every issue named, in plain English · free re-scans for 90 days

Who this is for

Owners who want the complete technical picture and are happy to work through it themselves — or hand it to a developer who can. You get every one of the 52 checks, including the deeper security scans. What you don't get is someone telling you which two of twenty findings matter this week, or a roadmap putting them in order. If you want that, it's Expert.

What we are, and what we're not. AegorIQ is a website auditor. We check your website and tell you what we found, why it matters, what it could cost you, and exactly how to fix it. We don't fix it for you, and we're not web designers or developers: we're the independent party that checks your website. You can hand our report to whoever looks after your site, or do it yourself; every finding is written to be actionable either way.

Everything in Essentials — plus the 16 deeper scans

Everything in the Essentials audit
All 36 Essentials checks, in fullYour policies read and graded, business identity, email spoofing protection, domain security, site security, trackers, performance and AI readiness. See the full Essentials list on its own page — every line of it is included here.
16 deeper scans Essentials doesn't run
Exposed sensitive filesAre private config files, admin pages or repository data sitting on your site for anyone to download? Attackers scan for these daily.
Directory listingCan a stranger browse and download every file in your folders — backups, spreadsheets, invoices — just by visiting the folder? "Not linked" isn't the same as "not public".
WordPress XML-RPC exposureFor WordPress sites — the legacy XML-RPC feature can let attackers try hundreds of passwords in a single request, and overload your site.
Leaked API keys & secrets in your codeAre your passwords or access keys visible in the code your site sends to every visitor's browser?
Exposed backup & config filesCan anyone download a full copy of your website — often including your database password?
Payment-skimming surface (third-party script integrity)Could a hacked third-party script steal card details at your checkout? This is the attack that hit British Airways and Ticketmaster.
Insecure cookiesCould someone hijack a logged-in customer's session?
Subdomain takeover riskCould someone claim an abandoned part of your domain and phish your customers from your own web address?
Exposed non-production subdomainsAre your test, staging or admin sites publicly visible? They're usually far less protected than your real site.
Exposed service portsAre there admin doors left open to the internet? A safe, limited check.
TLS / encryption strengthDoes your server still accept old, insecure connections that fail modern standards?
Mixed contentAre parts of your secure page loading insecurely — quietly breaking the padlock your customers rely on?
Advanced email security (MTA-STS & TLS-RPT)Is your email encrypted on its way to your customers, and are you told when it isn't?
Performance & SEO (Google Lighthouse)How fast is your site really, and can Google read it properly? Includes Core Web Vitals.
Accessibility barriers (WCAG 2.2 AA — automated)Colour contrast, missing image alt text and unlabelled form fields — named element by element, with the colour pairs and the ratios they need. An automated check finds common barriers; it is not a full WCAG conformance assessment, and the report says so.
Admin sign-in exposure & MFA signalsIs your admin login reachable from the open internet, does it hand off to a single sign-on provider, and is a two-factor plugin visible? Read-only — we never submit a login form.
Accuracy guarantee. In addition to your rights under the Australian Consumer Law. Refund policy. Free re-scans for 90 days while you fix things. Started with Essentials? Move up to Deep Scan within 30 days and pay the $70 difference.
Deep Scan

Every check we run, named in plain English.

All 52 checks, the deeper scans included, and free re-scans for 90 days.

Get Deep Scan — $149 Start with the free Scorecard
Essentials, $7936 checks, every issue named in plain English. Expert, $497All 52 checks, a professional's review, and 45 minutes working through your site with the Trust Framework.