MERQIVIO SECURITY SCAN

How secure does your webshop look from the outside?

Check publicly visible security risks around HTTPS, security headers, WordPress exposure and sensitive endpoints. The quick check is free; the full report with evidence and remediation priorities costs €9.95.

🔒

What we can check externally

HTTPS and transport security
Security headers such as CSP, HSTS and anti-framing
Public WordPress version and user information
debug.log, readme.html and directory listing
XML-RPC and other publicly visible WordPress signals

An external scan cannot prove that WordPress contains no malware. The Merqivio Security plugin is designed to check files, logins and changes from inside WordPress.

WordPress security scan and active protection

A WordPress security scan shows which security signals are visible from the internet, including HTTPS, security headers, WordPress exposure, XML-RPC and publicly reachable sensitive files or endpoints. Ongoing protection also requires security controls inside WordPress.

From security check to WordPress protection

Merqivio Security complements the external scan with Login Shield, 2FA/TOTP, reCAPTCHA or Turnstile, security headers, File Integrity Monitor, malware and ZIP scanning, audit logging and IP management. This combines a WordPress security check with active protection inside the installation.

View the WordPress Security Plugin →

SAFE & PLATFORM-INDEPENDENT

We do not need access to your webshop

Merqivio checks only information and technical signals that are publicly reachable from the internet. Shopify, WooCommerce, PrestaShop, Magento, Shopware, OpenCart or custom-built: our external scans do not require an admin account.

✓ No passwords or admin account✓ No FTP, hosting or database credentials✓ No changes to your webshop✓ Publicly reachable information only

No penetration test or break-in attempt

The Security Scan does not attempt to log in, guess passwords, run brute-force attacks or actively exploit vulnerabilities. Merqivio assesses publicly visible security signals only.

Works with many webshop platforms

ShopifyWooCommercePrestaShopMagentoShopwareOpenCartCustom

Available checks vary by scan and platform. WordPress-specific Security checks and the Merqivio Security plugin apply only to WordPress/WooCommerce.

Explore platform-independent webshop scans →

Scanners updated for the latest EU rules

Latest legal review: 6 September 2026. Merqivio revalidated relevant scan criteria against EUR-Lex and official European Commission sources.

Security: CRA reporting from 11 September

The Security scan references the Cyber Resilience Act for products with digital elements. Reporting duties for actively exploited vulnerabilities and severe incidents start on 11 September 2026. Because this is primarily a manufacturer/process obligation that cannot reliably be proven from a webshop URL, Merqivio treats it as scope/manual verification rather than an automatic webshop failure.

European Commission · Cyber Resilience Act

What this means

Merqivio distinguishes publicly demonstrable website issues, future duties and requirements that need product, supplier or internal business evidence. This avoids both missed risks and false failures. A scan is an automated risk assessment, not legal advice.