Features

Everything you need to discover, understand, fix and monitor your security

19 automated checks, a transparent score, Brand Shield, a grounded AI Copilot, monitoring and reports — in one calm, plain-English product.

Security Autopilot

Continuous, passive assessment of the public side of your business.

Domain & DNS health: Resolution of A, AAAA, NS and MX, nameserver redundancy, CAA, DNSSEC delegation signer, and dangling-CNAME indicators on common subdomains.
Email authentication: SPF (syntax, duplicates, risky endings, lookup indicators), DKIM key discovery at common selectors, and DMARC policy, reporting and rollout analysis — with p=none / quarantine / reject explained in plain language.
TLS & HTTPS: Trusted certificate, days to expiry, negotiated TLS version, HTTPS availability and HTTP→HTTPS redirect.
Website hardening: HSTS, Content-Security-Policy, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, clickjacking protection, cookie flags, mixed-content indicators and security.txt.
Technology exposure: Public fingerprints for platforms (WordPress, Shopify, Wix…), frameworks and servers, and whether exact versions are disclosed.
Transparent score: PixelPrivate Security Score 0–100 with published, configurable weights; every change is explained by the findings that caused it.

Turn findings into fixed problems — without PixelPrivate touching your systems.

Evidence-first findings: Each finding carries evidence, severity, confidence, business impact, technical detail, the check that produced it and a timestamp.
Step-by-step fixes: Plain instructions you can follow or forward to your IT provider or host.
Copy-paste configuration: Exact DNS record type, name, value and TTL, or the header value to add.
Verify fix: Re-run the relevant checks, mark the issue fixed, update the score and keep the history.

Detect lookalike domains and websites that may impersonate your business.

Lookalike generation: Typos, omitted/duplicated/swapped characters, look-alike characters (rn/m, 1/l), keyboard-adjacent keys, hyphenation, keyword combinations and alternative TLDs.
Passive risk analysis: DNS first; then a capped, safe retrieval of the public homepage of registered candidates: password fields, brand name, title and text similarity, credential wording, favicon similarity.
Risk and confidence: LOW to CRITICAL risk, separate confidence level, and the exact reasons — never a legal determination.
Triage that respects your time: Investigate, mark suspicious, mark reported, dismiss, allow-list your own, partner or competitor domains. Dismissed threats do not alert again unless risk materially rises.

Plain-English answers grounded in your own scan results.

Explain & prioritise: “What should I fix first?”, “Why is my score low?”, “Is this serious?”
Write it for the audience: “Explain this to my boss”, “Write a message to my IT person”, “Give me instructions for my hosting provider”.
Grounded by design: Scanner → structured facts → risk engine → explanation. The AI never invents findings, and deterministic templates answer even when AI is switched off.

Know when something changes — not weeks later.

Scheduled scans: Weekly on Free, daily on every paid plan, with duplicate scans prevented.
Change detection: New and resolved findings, score movement and the reason, across DNS, certificates, headers, email authentication and brand threats.
Alerts you control: Email and in-app alerts for new critical/high findings, score drops, certificate expiry and suspicious lookalikes, with your own severity threshold.

Evidence you can hand to a boss, a client or an insurer.

Security Assessment report: Score, breakdown, findings by severity, remediation status, methodology and limitations — print or save as PDF.
Shareable links: Unguessable, expiring and revocable. Summary by default; detailed only if you choose.

A security product should be held to a higher standard.

Hardened scanner: Public hosts only; DNS resolved once and pinned; every redirect re-validated; strict time, size and port limits. Private, loopback, link-local and cloud-metadata addresses are blocked.
Tenant isolation: Every customer is a separate organization with roles (owner, admin, member, viewer) enforced on the server for every request.
Abuse protection: Bot protection and per-IP, per-domain and per-account limits so the scanner cannot become a reconnaissance tool.
Honest limits: Published methodology, known limitations and no certification claims.

Roadmap

These are not in the product today and are listed so you can plan around them.

Looking for the details of how checks work? Read the security methodology.

No credit card. Full Pro switches on the moment you sign up.

No credit card · Cancel anytime · Reverts to the Free plan automatically