We check your sites from outside, match vulnerability feeds, and tell you what to patch — by when, then re-check after the fix.
A flaw in PHP itself, not a plugin. Checklists for Bitrix, WordPress and VPS — plus an outside check with no agent.
From a list of your sites to a clear answer: what to patch, by when, and a check after the fix.
Your sites, subdomains and services — including forgotten and brand-new ones. Plus domain expiry and SSL.
We compare the software on your sites with CVE, BDU and other feeds. On top — what attackers already use online.
A safe look from outside. “Confirmed” only if the issue is really open — not just a version name match.
Owner, deadline, email if you’re late, and a re-check. On Business — deeper API checks if you agree.
Nothing to install on servers, no passwords to share. We look from the outside — the way any visitor or attacker would.
Add the company’s site address. We’ll find the subdomains and services.
Add one TXT record in DNS. That’s how we know the domain is yours.
First results in about 10 minutes. After that the check runs on its own.
No server access, no agents
We find sites, match feeds, confirm the issue, set a deadline and write a report. Nothing to install on the server.
Your domains, subdomains and services. The list updates itself when a new server shows up.
Exposed files with passwords, services with no password, leaked keys and outdated software — plus matching against eight sources.
Each issue is safely checked. “Confirmed” only after a real probe; on top — what attackers already use online.
On Contour — a deadline on the finding, email if you’re late, and a re-check after the fix. On Business — time to answer and to fix, webhooks into your tools, AI assistants over MCP, FSTEC/CRA reports and deeper API checks with consent.
Not only CVEs: registration expiry, HTTPS certificates and sudden subdomains. In every plan; on Radar — once a week.
We warn before registration lapses, so the site doesn’t drop at the registrar.
Expiry, chain and hostname. An email if HTTPS is about to break.
A forgotten staging box appears online — straight into the list and your inbox.
Free on Radar · daily on Contour
A scanner often says “version matched”. We mark “confirmed” only after a safe check from outside.
Version and port matched a known vulnerability
The service answered from outside with no password
In a few minutes you see if it’s on your sites. No week spent in a spreadsheet — patch today, or safely skip it.
nginx on www.acme.com · update by end of day
Nothing to install: enter your site’s address — and the check starts right away.
A typical scanner calls half the list “critical”. We raise what is already used in attacks, has a ready exploit or a high chance of attack — not a high CVSS score alone.
2 users
1 domain
We watch from the outside and warn you. Touches nothing.
5 users
Checks on your schedule, confirmation and fix deadlines.
20 users
Several domains, regulator reports, webhooks and MCP for AI assistants.
Enter your website’s address and confirm it’s yours by adding one record in your domain settings (a DNS TXT record). signalfort then finds your sites and servers, works out what software they run, and shows the known vulnerabilities, most important first. First results arrive in 10 minutes.
No. We look at your sites from the outside, the way any visitor or attacker sees them. Nothing to install, no passwords to share.
A scanner hands you a long list of possible issues, and it’s hard to know where to start. We safely check each one, drop the false alarms, put on top flaws already used in attacks online — and follow remediation through to a re-check.
Files with passwords and settings left open to everyone, database copies, services with no password, leaked access keys, outdated software with known vulnerabilities, and expired or misconfigured HTTPS certificates. On Business — also API and access checks with your test accounts (only if you explicitly agree).
Yes. We look at FSTEC BDU, CVE, GHSA/OSV, EUVD and CIRCL. On top — flaws already used in attacks (CISA KEV), easy to exploit (EPSS) and ones with a ready exploit (Metasploit). Feeds update every hour.
On Radar, once a week: domain expiry, SSL, subdomains and CVE matching. On Contour and Business you choose how often and when, down to daily, and safe active checks from outside are added. If something important appears or a fix deadline passes, you get an email.
Up to 5 domains, priority in the check queue, a full report plus FSTEC and CRA exports, and time to answer and to fix. Send events to your own tools by webhook, and connect signalfort to an AI assistant over MCP: Claude, Cursor, VS Code and others. The assistant sees your sites and findings without access to your server. Deeper API and access checks with your test accounts run only with your explicit consent. 24-month history.
Three plans. Radar is free. After the first domain verification you get 14 days of Contour with no card. Then Contour is 1,490 ₽/month (1 domain, +990 ₽ each extra) and Contour Business is 4,490 ₽/month (5 domains, +790 ₽ each extra). Yearly = 10× monthly (−2 months). Monitoring is in every plan; 10+ domains and SSO are invoiced.
Create an account and add your site. First results in 10 minutes.