Changelog

A grade earned from a surface scan and a grade earned from a full deep scan used to look identical. They answer very different questions, and that difference now travels with the score.

WHAT CHANGED

• ▸Under the grade you now see how many checks ran and how many did not. A surface scan runs a smaller set than a verified deep scan, and the number says so.
• ▸Areas we could only examine in part no longer say "Clean". They say the checks that did run found no issues, at surface depth.
• ▸Sign-in, database access rules and API routes cannot be reached from outside your site. Verifying that you own the domain is what runs those checks.
• ▸A result served from our 24-hour cache now carries the same detail as the scan it came from.

WHY IT MATTERS An area we did not fully examine is unknown, not clean. Saying otherwise is the one mistake a security tool should never make. Nothing about how we score has changed, and no existing score moved.

This morning's update scored each area of your report on its own evidence. Today's follow-up makes sure those areas tell you the truth.

WHAT CHANGED

• ▸Areas are now judged against the checks your scan actually runs. A public check runs a smaller set, so areas that had finished were marked "Not checked" against a list that never applied to them.
• ▸We no longer name your firewall as the reason a check did not finish unless the scan actually watched it turn us away.
• ▸A scan that meets bot protection keeps checking. It slows down and stops retrying the refused check instead of stopping altogether, so more of your site is covered in one run.
• ▸The exposed-files check no longer reads as blind on sites that answer every path with the same page.
• ▸The Domains page no longer offers a Cloudflare fix for a block that did not come from Cloudflare.

No score or grade changed. Existing reports pick up the area and wording fixes next time you open them.

Until now the score was all or nothing. If too much of a scan was turned away by a firewall, the whole report came back with no score and no grade, even when several checks had completed perfectly. You were shown a blank result while real, finished findings sat behind it.

WHAT IS NEW

• ▸Your report now scores each of the seven areas separately: Secrets & Credentials, Security Headers, SSL/TLS, Auth & Access, DNS & Email, Database Exposure, and Dependencies & CVEs.
• ▸An area we were able to check completely gets its own score, even when the rest of the scan was blocked. In practice that usually means you still get a full result for DNS, email and TLS, because those checks do not depend on reaching your site directly.
• ▸An area we could not finish is labelled "Not checked" with a dashed ring. It is never counted as a pass.
• ▸An area where we found real issues but could not finish every check keeps its findings and is marked "Partial", so you can read its score as a floor rather than a full picture.
• ▸The breakdown is available on every plan, including Free.

WHAT HAS NOT CHANGED The overall score and letter grade still follow the same rules and the same thresholds as before. Nothing was loosened. We would rather show you nothing than show you a clean score for something we could not actually see, and that principle now applies area by area instead of to the whole report at once.

WHAT TO DO Open any report and look under the score. If areas are marked "Not checked", verifying your domain gives the scanner the access it needs to complete them on the next run.

Firewalls, WAFs and bot protection cannot tell an owner-authorized security scan apart from unknown traffic. Parts of a scan could be turned away, and the report came back incomplete with no way for you to fix it, because the scan never arrived from an address you could identify.

That changes today.

WHAT IS NEW

• ▸Scans of a domain you have verified now leave from a single fixed UNPWNED address instead of a shared pool that changes.
• ▸The current address is published at /scanning-ips.json, and any report that needs it shows it next to the exact hostname it applies to, ready to copy.
• ▸If you have connected Cloudflare, the allow rule is created for you automatically, scoped to that one hostname and that one address.
• ▸On every other provider, the report now walks you through adding the same narrow exception in your own firewall, step by step.

WHAT THIS IS NOT This is not a way around your protection. The address is identified, published and permanent, and nothing changes on your side until you approve it. Scans continue to honour robots.txt. We will never ask you to disable your firewall, your bot protection or your rate limits, and any exception you add should stay limited to one hostname and one address.

WHAT TO DO Verify the domain, then allow the published address for that exact hostname. Verifying alone routes the scan correctly, but the exception is what removes the gaps. Your next scan should come back complete instead of partial, with a full letter grade rather than a partial score.

Always confirm the current address at /scanning-ips.json before you create a rule.

CVE Radar alerts are now limited to domains you have verified you own, matching what your CVE Radar dashboard already showed. Previously an alert could reference any host you had scanned in the last 35 days, including one-off scans of sites you do not run. Scheduled monitors are unaffected and keep alerting on every domain you monitor.

Your dashboard can now answer a question it could not answer before: what of yours is actually reachable from the internet.

ATTACK SURFACE (new, in the sidebar)

• ▸Every subdomain, open port, certificate, technology, endpoint, exposed file and third-party service found on your verified domains, grouped into four layers.
• ▸A map that places what you hold at the centre and what you rent at the edge, so your most sensitive exposure sits where your eye lands first.
• ▸A change summary against your previous scan: what appeared, what disappeared, what moved.
• ▸A layer we could not measure says so. It is never shown as an empty, clean layer.
• ▸Free plans see every count on every layer. Paid plans open the full inventory, the change summary and export.

A DASHBOARD THAT SAYS WHAT IT IS MEASURING

• ▸Your domains are now listed by what needs attention first: critical, then high, then never scanned, then overdue for a re-scan. A clean result from three months ago now ranks below a clean result from this week.
• ▸The score trend follows a single domain instead of interleaving several, so the line means something.
• ▸CVE Radar counts only the domains you have verified as your own.

PLANS AND BILLING

• ▸Plan changes, upgrades and proration are handled reliably end to end.
• ▸Clearer billing information, and safer handling of subscription events.

POLISH

• ▸One icon and colour language across the dashboard, the report and the live scan view.
• ▸Contrast and layout fixes on the homepage and the feature sections.

UNPWNED now handles modern hosting and traffic protection more intelligently, with better coverage across Cloudflare, Vercel, and other managed platforms.

• ▸Adapts scan pacing to the detected hosting environment and honors Retry-After.
• ▸Respects robots.txt and records denied checks instead of silently treating them as clean.
• ▸Prevents overlapping scans of the same target from throttling each other.
• ▸Retries temporary network failures safely while keeping scans within their authorized scope.
• ▸Shows exactly which checks succeeded, were blocked, or remained inconclusive.
• ▸Gives clearer setup guidance when a firewall limits access.

Scores now reflect only the checks we could actually assess. If a target still restricts security testing, the report is marked partial instead of guessing or presenting a misleading clean result.

Run a check at unpwned.io/check and you'll now see one of the actual findings from the scan right in the results, plus an honest breakdown of what an account unlocks (every medium and low finding, re-scans after each fix) versus Pro (critical and high findings with step-by-step fixes). Scanning a site behind a firewall? You can now verify ownership straight from the results to unlock the full picture, and clean scores get a one-click path to the deep scan included with your account. Not ready to decide? Use "Email me this report" and we'll send your report link - one email, that's it.

Every scan now checks the software running on your site against known CVEs, not just deep scans. When we find one, the report shows it in full: the CVE ID linked to the official advisory, its CVSS severity, whether it is on CISA's actively-exploited list, how likely it is to be exploited in the wild, and the version that fixes it. Pro reports and PDF exports include the exact CVE IDs and patch versions. Behind the scenes we refreshed our vulnerability database to sync newly-exploited and newly-updated CVEs daily, and made monitoring alerts smarter, so you only hear about a CVE when the version we actually detected on your site is affected.

We published our live research page at /research: aggregate security data from 800+ production websites, comparing AI-built (vibe-coded), modern-stack, and traditional sites. Key finding: AI-built sites expose secrets at 3.8x the rate of traditional sites and ship critical vulnerabilities 2.8x as often, while average scores look almost identical. The numbers update automatically as the dataset grows. Aggregates only: no individual site is ever identified, and groups under 30 sites are hidden.

UNPWNED is now built around the domains you protect. Solo (1 domain), Studio (5 domains), and Scale (15 domains) each include unlimited re-scans, continuous monitoring with alerts, full finding details, and AI fix prompts. Free still shows what is exposed on any site, and now lets you re-check the same domain once a month.

Already on a paid plan? Nothing changes. Your price and access stay exactly the same.

Launch offer: 25% off your first payment with code LAUNCH25, applied automatically at checkout through August 31.

Settings and Findings were tightened across desktop and mobile: compact stats, cleaner menus, better Sand/Dark contrast, and more reliable mobile navigation. Cloudflare can now connect through one-click OAuth for domain verification, DNS fixes, and scanner access. OAuth is ideal for quick scans and fixes; use an API token when you need a persistent 24/7 monitoring connection.

We shipped a Cloudflare scanner access update. UNPWNED now uses published static scanner IPs with one-click Cloudflare IP Access Rules, pre-checks whether the rules already exist, preserves the last reliable score when WAF blocks monitoring, and shows Cloudflare guidance in blocked scan reports. If you connected Cloudflare before this update, reconnect it in Settings so the token includes Firewall Access Rules permission, then use Allowlist scanner IPs.

Fixed an issue we flagged? Pro now re-scans the same site and shows a before/after diff: what is fixed, what is still open, and any new regressions introduced by the change. Your first scan of any domain stays free; re-scanning the same domain to verify a fix is part of Pro.

This update focuses on privacy, accessibility, and transparency.

**AI suggestions control (new).** You can now turn AI-generated fix suggestions on or off in Settings. When off, your scans still run and show scanner-based findings, but no scan data is sent to an AI provider.

**Accessibility.** Improved text contrast and keyboard focus across the app for better readability and screen-reader support.

**Privacy by design.** Our security analysis sends only technical findings to AI providers, never your secrets, credentials, or personal data. We also clarified your cookie and data controls.

**Updated Terms and Privacy Policy.** Clearer wording on email preferences, billing, and your rights, plus a Hebrew summary of the key consumer terms for users in Israel.

You can manage AI suggestions and cookie preferences anytime in Settings.

Two improvements to scoring and reporting:

• ▸CSP rating calibration: `unsafe-inline` alone in script-src is now rated High (was Critical), matching Mozilla Observatory, OWASP, and Google csp-evaluator. Critical severity is reserved for `unsafe-eval` or proven XSS.
• ▸Cleaner reports: HSTS and clickjacking findings no longer appear twice under different titles in some reports.

You can now upgrade or switch your Pro plan directly from the pricing page or your billing settings — no need to cancel and resubscribe. Upgrades take effect immediately with a prorated charge. Downgrades take effect at your next billing cycle, so you keep your higher limits until then.

When a domain has been scanned recently, you now see those results instantly. No waiting. Verified domain owners and Pro users always get fresh scans on every request.

We rebalanced how grades are calculated. Common best-practice gaps (missing CSP, DNSSEC, SPF, security headers) no longer push your score down as harshly. Critical risks like exposed secrets, open databases, and cloaking still trigger an instant F. Most sites will score 5-10 points higher under the new model.

What changed:

• ▸Severity weights softened: high (-10 → -8), medium (-5 → -3), low (-2 → -1).
• ▸Critical raised slightly (-20 → -25), but more importantly the F cap is now applied LAST in the pipeline so no bonus can bypass it.
• ▸Grade thresholds lowered: A 88+, B 78+, C 65+, D 50+. F is now <50 (or any critical/cloaking finding).
• ▸A+ now requires 95+ score, 2 bonuses, and zero high/critical findings.
• ▸Your last scan has been re-graded automatically with the new methodology.

Read the full methodology at /methodology

Scan accuracy is significantly more trustworthy. When a scanner can't complete (timeout, blocked, or target unreachable), it is now reported as a coverage gap instead of silently passing as "clean", so your score reflects what was actually verified, not what was assumed. Telemetry and reporting have been hardened to match.

Monitoring is now watching the global vulnerability feed for you, not just rescanning your site.

What's new on your Monitoring page:

• ▸Live CVE feed from the NIST National Vulnerability Database — 113+ vulnerabilities tracked, updated nightly.
• ▸"Match Your Stack" counter — we compare every new CVE against the technologies we've detected on your scanned domains, and show only the ones that matter to you.
• ▸Per-domain attribution — when a vulnerability is relevant, you see exactly which of your domains is affected. No more guessing which site to patch.
• ▸New CVE Inventory page (/monitoring/cves) — full list of every matched CVE with severity filters, domain filter, and search.
• ▸Email alerts — the moment a new vulnerability is published that affects your stack, you get an email with the details (Pro) or a heads-up (Free).

Data source: NIST NVD. This product uses the NVD API but is not endorsed or certified by the NVD.

This is our biggest scoring update yet, rebuilt from the ground up after listening to real user feedback.

**What's new**

1. **Fair scoring for sites behind Cloudflare / WAFs.** If our scanner is blocked by active protection, you now earn a bonus - no more getting penalized for doing security right.

2. **Transparent A-F methodology.** Every point is explained on the new /methodology page. No black box, no hidden weights.

3. **Sub-score breakdown.** Every report now shows 7 category gauges (Secrets, Headers, SSL/TLS, Auth, DNS/Email, Database, Dependencies) so you see exactly where to improve.

4. **Peer benchmarking.** Every score shows where you stand against hundreds of real scanned sites ("Beats 87% of scanned sites").

5. **Bonuses toward A+.** HSTS, strict CSP, WAF, rate limiting, and SRI each earn a bonus. Stack them to reach the top grade.

6. **Clear share link.** Turning your report public is now a one-click action at the top of the report - no more hunting for it.

**What this means for your existing reports**

Reports scanned before April 18, 2026 show a small "Scored with methodology v0.9" banner. Your grade was computed under the old rules - rescan the domain to see your current grade under v1.0.

**Why we did this**

Users with Cloudflare kept getting punished for having good security. Users couldn't understand where their score came from. A+ felt meaningless when any clean scan could earn it. We fixed all three.

Thank you for the feedback that shaped this release.

UNPWNED now syncs vulnerability data nightly from the National Vulnerability Database (NVD). Scans automatically detect known CVEs matching your tech stack and version. Pro users get real-time alerts when new vulnerabilities affect previously scanned domains. Free users receive upgrade prompts for full details.

Connect your Cloudflare account to UNPWNED and unlock:

• ▸**One-click domain verification** - No more manual TXT records. Connect Cloudflare and verify your domain instantly.
• ▸**Auto-fix SPF & DMARC** - Found a missing SPF or DMARC record? Click "Auto-Fix" and we'll create it for you via Cloudflare.
• ▸**Inline auto-fix buttons** - SPF/DMARC findings now show an orange "AUTO-FIX" button right in your scan report.

**How to connect:** Go to Settings > Cloudflare Integration, or look for the Cloudflare tab when verifying a domain.

Your API token is encrypted with AES-256-GCM and never leaves our servers.

Added 9 new legal clauses to our Terms of Service: anti-scraping protection, feedback ownership, class action waiver, force majeure, assignment rights, export control and sanctions compliance, publicity rights, severability, and entire agreement. These additions bring our legal framework in line with industry-leading security platforms and provide stronger protections for both UNPWNED and our users.

New scanning policy page with full transparency on what our scans do, how to identify our scanner, and opt-out options for domain owners. Updated Terms of Service with expanded indemnification and scan risk disclosure. Enhanced scan authorization checkbox with clearer legal language.

Setting up monitoring just got way easier.

• ▸Enable weekly monitoring directly from your scan report - one click, no extra steps.
• ▸Full scan monitoring no longer requires domain verification. Just scan and monitor.
• ▸Deep scan monitoring (cloaking detection, HTTP method testing) still requires verification for legal compliance.
• ▸New scan type selector on the Monitoring page: choose between Full and Deep scan monitoring.

Previously, only 1% of users set up monitoring because it required domain verification first. That barrier is gone for standard scans.

**S3 Scanner Fix:** Eliminated false positives where well-known sites received unrealistically low scores. The scanner no longer reports access-denied (403) cloud storage buckets as security findings - only truly accessible buckets are flagged.

**More accurate results:** Scores now better reflect real security posture. Sites that were previously penalized for non-issues will see improved, more realistic grades.

We're excited to announce UNPWNED 2.0 - our biggest update yet.

Here's what's new:

• ▸Deeper scanning engine - even the standard scan now covers more ground and catches more issues
• ▸Improved stability - faster, more reliable scans across the board
• ▸Stronger platform security - we've hardened our infrastructure to keep your data safe
• ▸Better user experience - smoother flows and refined UI throughout
• ▸New knowledge pages - explore our growing library of security guides and resources

This release wouldn't have been possible without you. Your trust, feedback, and support drive everything we build. Thank you for being part of the UNPWNED community.

We're just getting started.

Your first scan now includes the complete Pro experience - detailed findings, fix instructions, compliance readiness, and PDF export. We also upgraded the PDF report design with improved layout and branding. Rate limit scanner improved with 2-phase detection (parallel warmup + sequential probing), broader header recognition, and smart handling of PWA/SPA sites that use catch-all service workers.

Deep scans now detect SEO spam injection and content cloaking. The scanner compares what your site serves to regular visitors vs search engine crawlers (Googlebot), flags suspicious sitemap counts, and identifies hidden text patterns. Available for verified domains only.

The feedback button is now "Support" - ask questions, report bugs, or share ideas and we'll reply by email. Monitoring is now limited per plan: Pro 5 gets 1 domain, Pro 20 gets 5, and Pro 100 gets 15 (domain + GitHub combined).

Major update: You can now schedule automatic security scans of your GitHub repositories. Get alerts via email, webhooks, and automatic GitHub Issues when secrets, vulnerable dependencies, or exposed config files are detected.

New scanning capabilities:

• ▸Config file detection (sensitive files like .env, credentials, private keys)
• ▸4 new deep scan checks added in V1.6 (CVE fingerprinting, error disclosure, form security, open redirect)
• ▸Deep scan reports now visually distinguished with premium design
• ▸Dashboard improvements: real-time last scan time, issues found counter

GitHub Monitoring is available for Pro users in the Monitoring page.

The deep scan engine just got a major upgrade with 4 new security scanners:

• ▸CVE Fingerprinting — Detects server and library versions, matches them against known CVE vulnerabilities. Now you'll see exactly which CVEs affect your stack.
• ▸Error Disclosure Detection — Probes your error handling for stack traces, database errors, and debug info leaks that expose internal architecture to attackers.
• ▸Form Security Audit — Analyzes HTML forms for missing CSRF tokens, insecure password fields, and unsafe form actions.
• ▸Open Redirect Detection — Tests redirect parameters to find phishing vectors that abuse your domain's trust.

Deep scan now runs 34 security checks (up from 30). Upgrade to Pro to unlock all deep scanners.

Email security checks (SPF, DMARC, DKIM) now correctly resolve to the root domain when scanning subdomains. Previously, scanning a subdomain could incorrectly report missing email records. You can now permanently delete your account and all associated data from Settings - fully GDPR compliant. Text readability improved across all marketing pages.

The platform selection step now remembers your choice - returning users skip straight through with one click. You can also switch the fix prompt tool directly from the results page without re-scanning. Fixed an issue where the Terms checkbox could not be tapped on mobile devices during signup.

Dismiss irrelevant findings from your report (Pro). Partial scan banner now shows how to whitelist the scanner. Cloud bucket detection improved to prevent false positives. Signup honeypot fix for browser autofill. Responsive UI improvements on mobile.

Notification cards now expand in-place to show the full message. View button navigates separately for a better reading experience.

Upgraded scoring algorithm for better accuracy, especially for sites behind firewalls or authentication. Added 5 new scanner checks: CORS, rate limiting, cloud storage, source maps, and cookie security. New security badge designs - gold (A+), silver (A), green (B). All existing reports have been recalculated.

30+ security scanners covering headers, DNS, SSL, CSP, CORS, privacy & compliance. AI-powered analysis with actionable fix instructions. Continuous domain monitoring with real-time alerts. Security badges (A+/A/B) to showcase your security score. PDF reports, GitHub integration, and promo code support.