Methodology & Research

How we scan, what we check, and why it matters

Most exploits aren't sophisticated. They target known, preventable gaps. This page shows you exactly what those gaps are — and what attackers do when they find them first.

Our mission

Security shouldn't require a security team

The vast majority of Shopify and WordPress store owners are not security experts. They're entrepreneurs, designers, and operators — people focused on their product, their customers, and their growth. Security is something that happens to them, not something they actively manage.

That's the gap we're here to close. Sekura gives any store owner a clear, plain-English picture of exactly what their site looks like to an attacker — without needing to understand HTTP headers, DNS records, or TLS handshakes to act on it.

Every finding comes with a description of the risk in real terms ("an attacker could send your customers a fake refund email from your exact domain") and a specific, prioritised fix. No jargon, no noise, no list of CVE numbers that mean nothing to someone running a store.

The uncomfortable truth: most sites aren't hacked because attackers are clever. They're hacked because the same basic gaps go unfixed. Every finding Sekura surfaces has a documented, real-world exploit behind it.


Core principles

How we operate

We build a security product, so we hold ourselves to a high standard. These are the non-negotiable rules every scan follows.

Passive only — always

Every check we run is equivalent to what a browser or a monitoring service does. We read public HTTP headers, look up DNS records, check SSL certificates, and inspect publicly available files. We never attempt logins, directory traversal, SQL injection, brute-forcing, or exploitation of any kind.

Secrets are redacted, not stored

If our scanner finds a real API key or password in a public JS file, we flag the finding but redact the value before it reaches our database. We store the type of credential found and its approximate location — never the credential itself.

You own what we scan

By submitting a domain, users confirm they have authorisation to scan it. Our terms of service are unambiguous on this point. We enforce per-IP rate limits to prevent automated abuse.

Data minimisation

We store only what's needed to show you your results and track your score over time: the domain, the findings, timestamps, and your risk score. We don't store the raw HTTP responses or page content from scanned sites.

Secure infrastructure

Our backend runs on a hardened server with a minimal attack surface. Authentication is handled by Supabase using industry-standard JWTs. Passwords are hashed by Supabase with bcrypt — we never see them. Database access is restricted to the API server.

Re-scan on your schedule, not ours

We never re-scan your site without your instruction or an active monitoring subscription. If you're on a free plan and walk away, we don't keep probing your domain in the background.


Scanner methodology

The 7 checks, explained

Every scan runs seven independent modules. Here's exactly what each one does, what it looks for, and how it stays passive.

01

Security Headers

Reads the HTTP response headers your server sends with every page load.

  • Content-Security-Policy (CSP) — blocks script injection and data exfiltration
  • HTTP Strict-Transport-Security (HSTS) — forces HTTPS, prevents downgrade attacks
  • X-Frame-Options — stops your pages being embedded in malicious iframes
  • X-Content-Type-Options — prevents MIME-type sniffing
  • Referrer-Policy — controls how much URL data leaks to third parties
  • Permissions-Policy — limits which browser features third-party scripts can access
How it stays passive · We make a single HTTPS GET request to your homepage and inspect the response. No authentication, no crawling.
02

DNS & Email Records

Queries public DNS to check the email authentication records protecting your domain.

  • SPF record — defines which servers are authorised to send email as your domain
  • DMARC record — instructs receiving servers what to do with unauthenticated email
  • DKIM selector — verifies email signatures are present and valid
  • CAA record — restricts which certificate authorities can issue SSL certs for your domain
How it stays passive · All lookups go through standard DNS. We never modify any records or interact with your mail server.
03

SSL / TLS

Inspects your certificate and the TLS configuration your server advertises.

  • Certificate validity and chain of trust
  • Expiry date — we flag certs expiring within 30 days
  • TLS protocol versions supported (TLS 1.0 / 1.1 are deprecated)
  • Certificate issuer and subject alternative names
How it stays passive · We complete a standard TLS handshake — the same thing any browser does when a visitor loads your site.
04

Public Exposure

Probes predictable paths that are commonly left public by accident.

  • Admin panels — /admin, /wp-admin, /manager
  • Backup files — .sql, .zip, .tar.gz archives at common locations
  • Config files — .env, config.php, database.yml
  • Debug endpoints and framework diagnostic pages
How it stays passive · We request each path and read the HTTP status code and response size. We do not download, store, or read the content of any file we find.
05

Secret Exposure

Reads public JavaScript files and source maps for patterns that look like credentials.

  • API keys and tokens (AWS, Stripe, Twilio, SendGrid and 40+ patterns)
  • Hardcoded passwords and private keys
  • Exposed source maps that reveal internal code structure
  • Environment variable leaks in bundled JS
How it stays passive · We only read files that are publicly accessible — the same files any visitor's browser would download. Any real credential found is redacted before it touches our database.
06

Subdomain Discovery

Enumerates subdomains using public DNS and certificate transparency logs.

  • Active subdomains and their resolution status
  • Dangling DNS — subdomains pointing to unclaimed cloud resources
  • Subdomains still resolving to decommissioned services
How it stays passive · We use public DNS queries and CT log data. No brute-forcing or zone transfer attempts.
07

Technology Fingerprint

Identifies the CMS, framework, and server software your store is running.

  • CMS and version (WordPress, Shopify, Magento, etc.)
  • Server software visible in headers (Apache, Nginx, version strings)
  • JavaScript frameworks and libraries with known CVEs
  • Outdated plugin indicators in public page source
How it stays passive · We read publicly visible metadata in HTTP headers and page source. No vulnerability exploitation — we only identify, never probe.

Real-world impact

What happens when these go undetected

Every gap Sekura finds has a documented, predictable outcome. These aren't hypothetical — they're the exact techniques used in real attacks every day.

Gap Sekura finds
What an attacker does with it
Missing Content Security Policy
Injects a payment skimmer into your checkout (Magecart) — customers' card details stolen in real time
No DMARC on your domain
Sends phishing emails from your exact address — your customers trust them because they look legitimate
Expired or weak SSL
Browser security warnings drive every visitor away; downgrade attacks let credentials be intercepted in transit
Exposed .env or config files
Extracts database passwords, API keys, and secrets in seconds — full account takeover
API keys in public JS bundles
AWS accounts drained, Stripe charges reversed, all data exfiltrated before you notice
Dangling DNS subdomains
Subdomain takeover — attacker serves malware or phishing from your brand's own subdomain
Outdated CMS or plugins with CVEs
Automated bots scan millions of sites daily; unpatched vulnerabilities are exploited within hours of disclosure

Research study

From our scan of 282 live stores

We passively scanned 282 live Shopify and WordPress/WooCommerce stores in June 2025. Every check was passive — no store owner was contacted, no credentials attempted, no content downloaded. The results are aggregated; no individual store is identifiable.

282stores scanned
250WordPress / WooCommerce
32Shopify
100%passive checks only

Data & privacy

What we store — and what we don't

When you scan a domain, here's the complete picture of what gets stored.

Data
Stored?
Domain name you scanned
Yes
Risk score and per-scanner scores
Yes
Finding titles and severity levels
Yes
Remediation guidance shown to you
Yes
Timestamp of the scan
Yes
Raw HTTP response bodies
No
Page content or HTML source
No
Real API keys or passwords found
No — redacted before storage
Your IP address (beyond rate limiting)
No
Customer data from the scanned store
No

See your exposure before an attacker does.

Free scan. Passive only. Results in under 30 seconds.

Scan your site free