NeoShield Security Quantum X
Scan Free
For freelance developers, WordPress maintenance providers, and small web agencies
Assess authorized client websites, prioritize publicly observable configuration risks, provide platform-specific remediation, and verify completed fixes with a rescan.
Email-only account · No credit card · Passive checks of public pages and DNS
Authorization required · No exploitation, brute force, fuzzing, login testing, or load testing
Website security report
0 confirmed findings · 98% coverage (44 of 45 checks) · 32 checks passed
+ 2 more informational observations
Real scan of NeoShield’s own website, 2 Nov 2026.
“To review” and “Info only” items do not reduce the score. The score covers publicly observable configuration only; it is not a penetration test or a certification.
Report vs_d74d7c310573965e193d2c1b
Pages from the complete sample report and its PDF. Demonstration data, not a customer’s website.
Show what was observed, where it was found, how severe it is, and why it matters in language a client can follow.
Provide platform-specific starting points for Nginx, Apache HTTP Server, Microsoft IIS, Cloudflare, WordPress, and AWS CloudFront when applicable.
Rescan after deployment and record each finding as resolved, partially resolved, still observed, or unable to verify.
One repeatable workflow for every client website you manage.
Confirm you may assess the website, then run a passive check of its public configuration.
Findings are ordered by severity, each with the evidence observed and its business impact.
Send the client a PDF summary and the developer the platform-specific fixes.
Verify each fix with a rescan, then schedule scans to catch changes that undo it.
One finding from the sample report, shown the way the product shows it: the evidence, the fix for the client’s platform, and the rescan that confirms it. Demonstration data
F-02 High
Configuration for the client’s platform
# server { } block (or http { })
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;Reload with: nginx -t && systemctl reload nginx. add_header in a location block replaces headers set at server level.
# Requires mod_headers (a2enmod headers)
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"Place in the VirtualHost or .htaccess, then run apachectl configtest and reload.
<!-- IIS 10 (version 1709+): applicationHost.config, inside the <site> element for this website -->
<hsts enabled="true" max-age="31536000" includeSubDomains="true" redirectHttpToHttps="true" />Native HSTS support is available from IIS 10 version 1709. On older versions, add the header with customHeaders.
SSL/TLS > Edge Certificates > HTTP Strict Transport Security (HSTS) > Enable HSTS
1. Max Age: 12 months
2. Include subdomains: only if every subdomain serves HTTPS
3. Preload: leave off until you are sureHSTS is cached by browsers for the full max-age; confirm HTTPS works on every subdomain first.
<?php
// In a small site-specific plugin (or the child theme's functions.php)
add_action( 'send_headers', function () {
header(
"Strict-Transport-Security: "
. "max-age=31536000; "
. "includeSubDomains"
);
} );Setting the header in the web server or CDN is preferred; use this when you only control WordPress.
CloudFront > Policies > Response headers > Create response headers policy
1. Security headers > Strict-Transport-Security: max-age 31536000, includeSubDomains
2. Origin override: enabled
3. Attach the policy to the distribution's cache behavior(s)Changes propagate to all edge locations within a few minutes.
Examples are starting points: test them in staging before production.
Verified fixed by a rescan on 8 Oct 2026
A finding is marked resolved only when a scan confirms it, and it reopens automatically if it comes back. Demonstration data.
People who look after other people’s websites and need to show that the work was done.
Small MSP teams that manage public websites use the same workflow. NeoShield for MSPs
Prepaid passes for 30 or 365 days. No automatic renewal.
¥0
1 website · 1 manual scan per month · up to 3 medium-severity findings in full per scan · 1 user
¥1,980 / 30 days
Up to 5 monitored websites · 100 manual scans per month · weekly monitoring · 1 user
¥7,980 / 30 days
Up to 25 monitored websites per included user · 100 manual scans per month · monitoring as often as daily · 5 users
Planned: Separate client workspaces with per-client access, Agency logo branding on reports, Monthly executive summaries
Planned No release date yet
One page per month for all the client websites you look after: what was checked, what was found, what was fixed and how the scores moved.
Available today: a report per website, report history, and Verify Fix results that show which findings were resolved. The combined monthly page is not built yet.
Monthly Security Summary
No critical findings observed
Illustrative example with invented figures. Not a customer result and not a measurement of NeoShield usage.
NeoShield launched in 2026. There are no published customer quotes, customer logos, case studies or usage numbers yet, and none will appear here until they are real and the customer has approved them in writing.
Agency case studies will be published with the agency’s name, its permission and the dates of the work.
Numbers such as websites assessed or findings verified will be shown only when they are measured, dated and reproducible.
Read the complete sample report and run one free scan on a website you are allowed to assess. Open the full sample report
Using NeoShield with client websites and willing to share how it went? Tell us
Single-purpose checks that remain free to use. They are separate from the website security reporting workflow.
Free checkers are good at the test each one runs, and SSL Labs tests TLS in more depth than NeoShield does. What they do not give you is one report a client can read, fixes for the client’s platform, and a record that each fix worked.
| Feature | SecurityHeaders | SSL Labs | MXToolbox | NeoShield |
|---|---|---|---|---|
| Security checks | HTTP security headers | TLS and certificates, in depth | DNS, mail server and blocklist lookups | Headers, TLS, cookies, exposed files, SPF and DMARC in one report |
| Client-ready report | Results page | Results page | Results page | PDF and CSV a client can read (Pro, Team) |
| Remediation guidance | Header explanations | Ratings and protocol detail | Problem descriptions | Fix steps for Nginx, Apache, IIS, Cloudflare, WordPress and CloudFront |
| Fix verification | Run the test again and compare by hand | Run the test again and compare by hand | Run the test again and compare by hand | Verify Fix records each finding as resolved, partly resolved or still present |
| Monitoring | Not part of the free test | Not part of the free test | Sold separately for DNS and email | Scheduled scans that flag regressions (Pro, Team) |
| Report history | Not organised by client website | Not organised by client website | Not organised by client website | The 100 most recent reports per account, by website |
| Agency workflow | One check, one website at a time | One check, one website at a time | One check, one website at a time | Client list, Security Center and shared seats (Team) |
| Price | Free | Free | Free lookups; paid plans for monitoring | Free plan; Pro ¥1,980 per 30 days |
Based on the public free versions of each tool as of November 2026. Product names belong to their owners; NeoShield is not affiliated with them. Use them alongside NeoShield. If something here is out of date, tell us and we will correct it. Report a correction
No. It is a fast, non-intrusive assessment of publicly accessible website security configuration: HTTPS and TLS, security headers, cookies, email authentication records, server disclosure and commonly exposed files. It does not exploit, brute-force, fuzz or log in to the website.
Only websites you own or have permission to assess, such as client websites covered by your service agreement. You confirm this before every scan and every recurring schedule.
One website and one manual scan per month. Every finding is named, with its severity, affected host, basic evidence and why it matters, and up to three medium-severity findings are shown in full. Complete evidence, platform-specific fixes, exports, Verify Fix, history and monitoring are part of the paid plans.
Paid plans export each report as a PDF or CSV that you can share with a client or developer, with optional "Prepared for" and "Prepared by" names. Reports carry NeoShield branding today. Agency branding is planned.
After the fix is deployed, run Verify Fix on the report (Pro and MSP / Team). NeoShield scans the same website again and records an outcome for each finding: resolved, partially resolved, still present, or unable to verify. A finding is only marked resolved when a scan confirms it, and it reopens automatically if it comes back.
Free checkers such as SecurityHeaders, SSL Labs and MXToolbox are good at the test each one runs, and SSL Labs tests TLS in more depth than NeoShield. NeoShield puts those public checks into one report a client can read, adds fix steps for the client’s platform, records whether each fix worked, and keeps the history per website. You pay for the reporting and verification workflow, not for the checks themselves.
One developer in Japan builds and runs NeoShield alongside full-time employment. Support is by email, with no live chat, phone or SLA. Scans, monitoring and payments run automatically when the operator is unavailable.
No. Paid access is currently sold as prepaid passes for a fixed period (30 or 365 days) with no automatic renewal. When the period ends, the account returns to the Free plan unless you buy another pass.
Read the complete sample report first, then run a free scan on a website you are allowed to assess.
Email-only account · No credit card · Passive checks of public pages and DNS
Authorization required · No exploitation, brute force, fuzzing, login testing, or load testing