The technical flaws that cost you rankings, before Google notices them

A compromised site does not lose its traffic on the day of the incident: it loses it the day Google flags it as hacked, and it recovers several weeks after the cleanup. We report the publicly observable signals that come before that scenario, and for each one we say what it costs in visibility.

Join the waiting list Request a demo

Access opens in waves: we email you when yours is ready.

Our numbers, with their provenance

12
security finding families measured
7
check families never performed measured

Two trades, one blind spot

The three situations below do not require anyone to target you: they happen because a file is readable and a bot goes past. They almost always come before the question « why did our rankings collapse this month? ».

01
The flaw is public, and it is tried continuously

A configuration file served by mistake answers any request coming from the Internet. Bots sweep the Web permanently to try those addresses, knowing nothing about you.
02
The penalty lands later, and it hits rankings

A compromised site serves pages its owner never wrote. Google detects them within days, flags the site as hacked in its results, and visibility drops. Recovery takes several weeks, after cleanup and a reconsideration request.
03
The subject falls between two teams

Your SEO provider does not look at headers or end-of-life components; your technical team does not follow your rankings. The signal is readable by everyone, and it is nobody’s job.

What we measure

Every signal, translated into a consequence for your visibility

A passive analysis reports what is already readable from the Internet, with no credentials and without changing anything. Each family of findings then arrives with the same reading apparatus, so the decision needs no interpreter.

The finding in plain words, not a rule identifier (an understandable title, what the flaw exposes, the action to take, a separate note for whoever will take it, and the known false positives of that family)
The search impact, written family by family (the scenario actually observed on the Web, from the readable file to mass spam page injection, through to the flagging and the recovery delay)
A reading comparable from one pass to the next (families are weighted by severity, from critical to informational, and the history keeps every pass with the scale that produced it)
Immediate verification after a fix (the cadence depends on your plan, and an analysis can be relaunched by hand as soon as a fix is live, because that is the moment this module is worth most)

Other modules

Pricing Request a demo

Frequently asked questions

Do you replace the work of a specialist?

No. We report what is already readable from the Internet, with a visitor’s means, and we translate every finding into a consequence for your rankings. A specialist works on your infrastructure, with access we do not have and do not ask for.

Do I have to authorise you, and can I reverse it?

A signed authorisation is mandatory: without it, no analysis starts. It is versioned, revocable at any time, and every acceptance is kept as dated evidence. A domain can also be blocked at platform level, at its owner’s request, whatever authorisation is in force.

Will this slow down or break my site?

The analysis reads your pages, it writes nothing to them. A ceiling bounds the number of passes per day and per site, and it is a platform rule no contract lifts: it protects your server, not our invoice. Immediate verification after a fix stays possible, because a minimum interval would have forbidden precisely the move you expect from us.

Why does an SEO tool look at these signals?

Because the penalty is a visibility penalty. A site flagged as hacked is progressively removed from results, and its traffic only returns after cleanup, a reconsideration request and several weeks of waiting. SEO tools do not report these signals, security tools do not talk about rankings: that intersection is what this module occupies.

The exact reach of this analysis

The module reports signals observable from the outside, with the same means as a visitor. It makes no claim to see what your site does not expose, and it does not replace a specialist working on your infrastructure.

What we cover

Whatever answers a public request, from the Internet, with no credentials
The technologies and versions readable in your site’s responses
Your domain’s status with Google Safe Browsing

Stated limits

Anything requiring an account, a password or access to your server
The code of your internal applications and your private repositories
Workstations, mailboxes and your company network
Any judgement on your regulatory compliance regarding data

The boundary of the analysis, and what enforces it

The check families below are refused at run time by the engine’s configuration, not by an internal instruction. A parity test puts this list against the refusals actually applied, in both directions: an exclusion enforced without being stated would be a guarantee wasted, an exclusion stated without being enforced would be a guarantee that is false.

No intrusive check
No bulk sending of malformed data
No injection attempt, in any form
No attempt to execute code
No credential attempt, including default ones
No driven browser launched on your pages
No verification routed through a third-party service

This module is neither a security audit nor a penetration test. It reports publicly observable signals and translates them into visibility impact.

See what your site exposes today

A single analysis says what is readable from the Internet, and what each finding would cost your rankings.

Join the waiting list Request a demo

Access opens in waves: we email you when yours is ready.

The technical flaws that cost you rankings, before Google notices them

Our numbers, with their provenance

Two trades, one blind spot

The flaw is public, and it is tried continuously

The penalty lands later, and it hits rankings

The subject falls between two teams