TesseraFind out what is wrong with your website's security, in a report you can understand
Enter the address, we analyse the site and deliver a PDF report in plain English: every issue comes with a CVSS score and instructions to fix it.
Nothing to install. Only for sites you are authorised to test.
The site does not force the browser to use HTTPS only: a first visit can be intercepted on an untrusted network.
What to do: configure the server to send the Strict-Transport-Security header with a duration of at least one year.
Four automated checks in a single pass
Every scan uses industry-recognised tools and states what was tested and what was not.
Security headers
The protections a browser applies only when the server asks for them: HSTS, CSP, X-Frame-Options and similar.
TLS configuration
Protocols, ciphers, certificate and known vulnerabilities of the HTTPS connection, with testssl.sh.
Known vulnerabilities
Thousands of Nuclei checks for exposed files, misconfigurations and default credentials.
Application scan
OWASP ZAP crawls the site and probes the most common weaknesses of web applications.
Areas behind a login
The check does not use credentials: pages that require a login are not analysed.
Business logic
Permissions between roles, multi-step flows and business rules need a manual test.
Manual confirmation
Results are automated and no operator has checked them one by one. The report says so.
From address to report in three steps
It takes a few minutes. You can close the page and come back: the scan keeps running.
Enter the address
Type the site URL. The first time, you prove it is yours with a DNS record or a file.
We analyse the site
Headers, TLS, known vulnerabilities and application scan, one after the other.
Get the report
A PDF and a web page, with an access link valid for 7 days.
A report you can hand to whoever has to fix things
Designed for people who run a website without a security team.
Declared standards
CVSS v3.1 score with a visible vector, CWE classification, structure based on PTES and NIST SP 800-115.
In English or Italian
Summary, descriptions and recommendations ordered by priority, in the language of the page you start the scan from.
Honest about limits
Every report lists what was not tested, so you never mistake an automated check for a penetration test.
Consistent risk
High, Medium and Low come from the CVSS score, not from a tool's raw label.
Choose how to use it
A check when you need it, or regular monitoring over time.
5-check pack
- For several sites or to re-check after fixing
- PDF report and web page
- No expiry
Monthly monitoring
- An automated scan every month
- Report for every scan, also by email
- Cancel any time
Prices exclude VAT. You pay on Stripe's secure page; Stripe sells the service on Hyperion's behalf and sends you the receipt and invoice. Monthly monitoring renews every month until you cancel it from your scans page.
Learn more
How Tessera works and answers to the most common questions about website security.
Quick Check methodology
Tools and versions, CVSS calculation, risk levels and the limits of the scan.
Penetration test or automated scan?
What each one finds, how long it takes and when to choose one or the other.
HTTP security headers
HSTS, CSP and the other headers: what they do and how to enable them on nginx, Apache and Express.
Frequently asked questions
What people ask us most often before they start.
What is Tessera?
Tessera is an online service by Hyperion S.r.l. that runs an automated security check on a website, the Quick Check, and delivers a report within minutes, in English or Italian, as a PDF and a web page, with a CVSS score and instructions to fix every issue.
Which checks does the Quick Check run?
Four, one after the other: HTTP security header review, TLS configuration analysis with testssl.sh, detection of known vulnerabilities and misconfigurations with Nuclei, and an application scan with OWASP ZAP (spider, passive and active scan).
How much does a website security check cost?
A single check costs €49, a pack of 5 checks costs €199 and monthly monitoring of one site costs €79 per month, excluding VAT.
What is the CVSS score?
CVSS (Common Vulnerability Scoring System) v3.1 is the standard published by FIRST to measure the severity of a vulnerability on a scale from 0 to 10. In the report every issue has its score and the vector it is calculated from, so anyone can verify it. High, Medium and Low are derived from that score.
Can I test any website?
No, only sites you own or for which you have written authorisation. Before the first scan of a site we ask you to prove that you control it, by adding a DNS record or publishing a file with a code we give you. The active scan sends test requests and may trigger alarms on the site being analysed.
Is it a penetration test?
No. It is an automated external check, without credentials and without manual verification. It finds many weak configurations and known vulnerabilities, but it does not replace a test carried out by an expert.
How long does it take?
Usually a few minutes, depending on the size of the site. You can keep the page open or come back to it later from the same address.
Can the test slow down my site?
The traffic is moderate, but the active scan sends many requests in a short time. If the site is fragile or business-critical, let us know beforehand.
Who can read my report?
Only people who have the signed link, valid for 7 days. Keep it safe or download the PDF: after it expires the link stops working.
How do I use the report to fix things?
Every issue has a description, a CVSS score and a recommendation. The final recommendations are grouped by priority, so you know where to start.
Ready to check your site?
Sign in with your email, buy your scans and start your first Quick Check in minutes.
Get started