E-shop security audit · WooCommerce · Magento · PrestaShop · custom

Security audit for your e-shop. Cookies, GDPR, payments.

We know how WooCommerce, Magento and PrestaShop behave, and where custom-built e-shops most often fail. We check whether your customers' sessions are protected, whether the redirect to the payment gateway stays on HTTPS, and whether your cookies comply with GDPR.

Passive scan · no signup · results in 30 seconds

https://

Scan takes 30 seconds. You can request the PDF report with a button on the results page.

How it works

3 steps · 30 seconds

Enter your e-shop domain

We detect the platform ourselves: WooCommerce, Magento, PrestaShop or custom.

E-shop-specific checks

Cookie attributes, GDPR/ePrivacy, payment redirect, mixed content, exposed configuration files.

Report with concrete steps

For each finding we explain what's happening and where your developer should fix it.

What we check on e-shops

E-shops deal with different things than blogs: sessions, payments, cookies, GDPR. Here are the 6 problems we see on them most often.

Cookiescritical

Session cookie without Secure

The cookie with the session ID also travels over HTTP. On public Wi-Fi an attacker can take over the customer's account.

Set-Cookie: PHPSESSID=…; Path=/

Paymentscritical

Payment redirect over HTTP

Between the cart and the payment gateway there's one step over HTTP. An attacker on the same network can redirect it elsewhere.

301 http://gateway/pay (downgrade)

GDPRwarning

Cookies set before consent

Third-party cookies (Google Analytics, Meta Pixel) are set before the consent banner is shown. The data protection authority can fine you for it.

Set-Cookie: _ga, _fbp (before consent)

Cookieswarning

Cookie without SameSite

Older browsers (Safari < 13) are vulnerable to CSRF. An attacker can place an order in the customer's name.

SameSite: not set

Mixedwarning

Mixed content on a product page

A modern browser blocks an image loaded over http://. The visitor sees a broken page and the owner has no idea.

img src: http://cdn.example/foto.jpg

Headerswarning

HSTS missing

Without HSTS the first visit often goes over HTTP. An attacker on hotel or café Wi-Fi can exploit that.

Strict-Transport-Security: (missing)

About Vulscan

We've worked with e-shops for years and know how WooCommerce, Magento and PrestaShop handle cookies and redirects, and where custom-built e-shops most often go wrong. For an e-shop it's not just about the GDPR fine. A leaked session means a lost customer.

hello@vulscan.app LinkedIn

Passive scan

No invasive tests. We behave like an ordinary visitor, and your site won't notice the check.

European context

We know local hosting providers, CMSes and registrars, so our recommendations are specific.

Real help

If you don't understand a finding, write to us. We'll answer.

Frequently asked questions

Do you scan the payment gateway too?+

We only scan the redirect chain from your site to the gateway (e.g. https://gpwebpay.cz). The gateway itself is monitored by the bank.

Does it work for a custom-built e-shop too?+

Yes. Custom-built e-shops usually have the most findings, because they lack the protections that ready-made platforms switch on themselves. In the report we tell you what your developer needs to change.

Is the scan safe? Won't it damage the site?+

Yes. The scan is passive and behaves like an ordinary visitor. We don't try exploits, crack passwords or send attack requests. Your site won't notice the check.

What do you do with the data? Where do results go?+

You see the most serious findings on the site right away. You can email yourself the full PDF report with one click. We keep your email so we can alert you if a new serious finding appears on your domain. You can unsubscribe at any time.

What if you find a critical problem?+

You'll get a report where every problem is explained with a concrete remediation step. Most things your webmaster can handle. If not, write to us. We're happy to take a look.

Free e-shop scan. Cookies, payments, GDPR.

The PDF report shows where your e-shop has holes and how to fix them. It works for open-source platforms (WooCommerce, Magento, PrestaShop) and for custom-built e-shops.