FAQ
Frequently asked questions
The free check
Is the free check safe to run on any domain?
Yes. The free check only reads public DNS records, the same data any mail server reads when it receives email from you. It sends nothing to the domain's web or mail servers and changes nothing.
Why do I have to verify my domain for a penetration test?
Because testing a website without its owner's permission is an attack. You put a small file on your website, which proves you control the site we will test; with the scope you confirm, it is your written permission to test it. The same works for a website without a domain, by its IP address (and port). A TXT record in your DNS is optional for testing: it proves the whole domain, adds its www host to the test and unlocks the advanced DNS check. We keep a timestamped record of that permission.
What happens to the domains I check?
Anonymous checks are not stored against you; we keep only what we need to enforce the daily limit. With an account, your checks are saved to your history so you can compare results over time. You can export or delete your data at any time.
What is the difference between the free and the paid account?
The free account adds the advanced DNS check: 5 a day on domains you have verified as yours, with history. It does not test your website. The paid account adds web penetration testing of your verified domains; its DNS checks are the same as in the free account.
How many free checks do I get?
3 basic checks a day on this site, with or without an account. With a free account, also 5 advanced checks a day in the dashboard on domains you have verified. The paid account has the same DNS checks.
Why test every month instead of once?
New vulnerabilities are published every day and we keep adding tests for them. A site that was safe last month may not be safe today. Continuous testing every month also shows whether the problems found earlier are fixed or still open.
For engineers
Technical questions
Does it replace a manual penetration test?
No. Automated testing finds the known, common weaknesses and finds them every month. A manual test finds logic flaws and chained attacks no scanner sees. Use both: manual tests occasionally, Offensly in between.
We do manual penetration tests too. Write to pentest@offensly.com with what you want tested (domains, applications, APIs) and when. We reply with a proposed scope and a price.
Can the DKIM check miss a key?
Yes. DNS has no list of selectors, so we try the common ones. With an account you can add your own selectors.
Which DNS checks are in which tier?
Basic, on this site for anyone: SPF, DKIM, DMARC, MX (3 a day). Advanced, in the dashboard with a free account, on domains you verify: all DNS checks, adding DNSSEC, CAA, DANE/TLSA, STARTTLS and dangling subdomains (5 a day). Paid account: the same plus web penetration testing.
For managers
Business questions
Why is continuous testing a yearly plan?
Most companies test their website once or twice a year. In the months between, new vulnerabilities are published and nobody checks. We think a website should be tested every month, so we made that the cheaper choice: a year of monthly tests costs $180, less than two one-off tests ($200). Paying for the year in advance is what lets us keep the price this low.
Why is a test $15 in continuous testing and $100 one-off?
Continuous testing is a year paid in advance: $180 for 12 tests. The first is a full test of everything in scope that maps your site and records every finding. That record is the baseline; each monthly retest runs the tests again and compares the result with it. A one-off test is the same full test, bought on its own.
Does this replace the penetration test our consultant does?
No, it complements it. A manual test goes deep once in a while; Offensly checks for known weaknesses every month in between. Many problems appear in the months between manual tests.
We can do the manual test as well. Email pentest@offensly.com with what needs testing and by when, and we send you a scope and a price.
Is it legal to test our website?
Yes, because you give permission. Testing runs only on domains or IP addresses you verify, in the scope and time window you confirm, and we keep a timestamped record of that permission.
Can it disrupt our website?
Tests run in the time window you choose, so you can schedule them outside busy hours. Tell your hosting provider if their terms ask for notice of security testing.
How do we pay?
By card through Stripe: $100 for a one-off test, or $180 a year in advance for continuous testing of a domain, renewed yearly until you cancel. A one-off test that cannot run is not charged. DNS checks stay free (5 advanced checks a day with a free account).
Accounts and data
Which sign-in options do you offer?
Google. We never see or store a password.
Can I delete my account?
Yes, in the dashboard under Account. Your checks, projects and results are deleted. Records we must keep for billing and the proofs of permission for tests that ran are kept as the law requires.
Can I export my data?
Yes. The dashboard exports your checks and results as a file.
Something else?
Write to contact@offensly.com. To report a vulnerability in Offensly itself, see Security.