Question 1

What is FortifyNet?

Accepted Answer

FortifyNet is a Swedish web security service offering free security audits, monitoring, and analysis. We test SSL certificates, DNS configuration, security headers, performance, and search for compromised accounts on the dark web.

Question 2

How much does FortifyNet cost?

Accepted Answer

FortifyNet offers a free 14-day trial. After that, it starts from $29/month for Starter. Professional is $79/month and Enterprise is custom priced.

Question 3

Do I need to install anything on my website?

Accepted Answer

No, FortifyNet requires no installation. Just enter your domain and we analyze it directly via APIs.

Question 4

How fast is the analysis?

Accepted Answer

The first analysis takes 30-60 seconds. This depends on domain complexity and server response time.

Question 5

How is FortifyNet different from other security scanners?

Accepted Answer

FortifyNet uses real APIs (SSL Labs, Google PageSpeed, HaveIBeenPwned) instead of cached data. We also provide step-by-step remediation guides tailored to your server.

Question 6

What is an SSL certificate and why do I need it?

Accepted Answer

SSL/TLS certificates encrypt data between visitors' browsers and your server. Without one, all data is unencrypted and can be intercepted.

Question 7

How long is an SSL certificate valid?

Accepted Answer

Most SSL certificates are valid for 1-2 years. FortifyNet warns you 30 and 7 days before your certificate expires.

Question 8

How do I renew my SSL certificate?

Accepted Answer

It depends on your hosting provider. If using Let's Encrypt, renewal is automatic with Certbot. Contact your host for specific instructions.

Question 9

What is the SSL Labs grade?

Accepted Answer

The SSL Labs grade (A+ to F) rates your SSL/TLS configuration. A+ is excellent, F means critical issues.

Question 10

Why am I getting a warning about TLS 1.0 and 1.1?

Accepted Answer

TLS 1.0 and 1.1 are outdated and contain known security vulnerabilities. You should only use TLS 1.2 and 1.3.

Question 11

What is SPF and why do I need it?

Accepted Answer

SPF (Sender Policy Framework) prevents others from using your email domain for phishing. It's a DNS TXT record that specifies which servers can send mail for your domain.

Question 12

What is DMARC and why is it important?

Accepted Answer

DMARC defines what happens to emails that fail SPF/DKIM checks. p=reject provides the strongest protection against email spoofing.

Question 13

What is DNSSEC?

Accepted Answer

DNSSEC protects your DNS from poisoning attacks by verifying that DNS responses are authentic.

Question 14

What is a CAA record?

Accepted Answer

CAA restricts which certificate authorities can issue SSL certificates for your domain.

Question 15

How do I add SPF, DMARC, or CAA records?

Accepted Answer

Add new TXT records in your DNS configuration via your registrar's control panel. FortifyNet provides the exact values to copy.

Question 16

What are Core Web Vitals?

Accepted Answer

Core Web Vitals are three Google metrics measuring user experience: LCP (loading speed), INP (interactivity), and CLS (visual stability).

Question 17

How do I improve performance?

Accepted Answer

Compress images, use WebP format, enable GZIP/Brotli compression, minify CSS/JavaScript, implement lazy loading, and use a CDN.

Question 18

Does performance affect my Google ranking?

Accepted Answer

Yes, Google favors fast websites. Poor performance can negatively impact both ranking and conversions.

Question 19

What is LCP and how do I improve it?

Accepted Answer

LCP measures when the largest content becomes visible. Improve server response, implement caching, and optimize images.

Question 20

What is CLS and why does it matter?

Accepted Answer

CLS measures unexpected layout changes. It frustrates users and reduces conversions.

Question 21

What is HSTS and do I need it?

Accepted Answer

HSTS forces browsers to always use HTTPS. It prevents man-in-the-middle attacks and downgrade attacks.

Question 22

What is Content Security Policy (CSP)?

Accepted Answer

CSP prevents XSS attacks by controlling which scripts and resources can load on your site.

Question 23

What is X-Frame-Options?

Accepted Answer

X-Frame-Options prevents your site from being loaded in an iframe on malicious websites, protecting against clickjacking.

Question 24

What is X-Content-Type-Options?

Accepted Answer

This header prevents browsers from guessing file types, protecting against MIME-sniffing attacks.

Question 25

Which security headers are most important?

Accepted Answer

HSTS, CSP, X-Frame-Options, X-Content-Type-Options, and Referrer-Policy are the most critical.

Question 26

What is dark web monitoring?

Accepted Answer

We search through 12+ billion exposed accounts from known breaches to see if your domain appears.

Question 27

How do I know if my account was breached?

Accepted Answer

FortifyNet searches the HaveIBeenPwned database and alerts you if email addresses linked to your domain appear in breaches.

Question 28

What should I do if my account is exposed?

Accepted Answer

Change password immediately, enable two-factor authentication (2FA), review access logs, and consider incident response help.

Question 29

Do you sell my data?

Accepted Answer

No, we never share your personal information. We only search for your domain in public databases of exposed data.

Question 30

How often is the dark web database updated?

Accepted Answer

HaveIBeenPwned updates regularly as new breaches are discovered. We check against it in real-time.

Question 31

What is Exposure Scan?

Accepted Answer

Exposure Scan crawls your website to find exposed files, JavaScript secrets, misconfigured cloud buckets, and other security issues.

Question 32

What files do you search for?

Accepted Answer

We search for .env files, backup files, .git folders, configuration files, swagger.json, and other sensitive file types.

Question 33

Can you find passwords in my code?

Accepted Answer

We search for API keys, authentication tokens, and other secrets often embedded in JavaScript.

Question 34

What are misconfigured cloud buckets?

Accepted Answer

AWS S3, Google Cloud Storage, or Azure Blob Storage set for public access without proper access restrictions.

Question 35

Is Exposure Scan safe for my website?

Accepted Answer

Yes, we only crawl public content already accessible on the internet. We perform no destructive testing.

Question 36

Is FortifyNet GDPR compliant?

Accepted Answer

We use GDPR-aligned handling with minimal personal data. We follow GDPR requirements and never share your personal information.

Question 37

What is NIS2?

Accepted Answer

NIS2 is an EU directive on cybersecurity that applies to critical infrastructure organizations.

Question 38

What is the AI Act?

Accepted Answer

The AI Act is EU legislation regulating AI systems, focusing on transparency, data governance, and human oversight.

Question 39

Which GDPR requirements do you check?

Accepted Answer

We check privacy policies, cookie consent, tracking script consent, and data processing compliance.

Question 40

Can you help me become GDPR compliant?

Accepted Answer

Our Compliance Scan provides a detailed report with recommendations for remediation.

Question 41

What is WHOIS?

Accepted Answer

WHOIS is a database of domain registration information showing registrar, expiry date, and nameservers.

Question 42

How do I protect my WHOIS information?

Accepted Answer

Most registrars offer WHOIS privacy to hide your personal information from public searches.

Question 43

What should I do if my domain is expiring soon?

Accepted Answer

Renew it immediately via your registrar. Enable auto-renewal to prevent future issues.

Question 44

What are nameservers and why are they important?

Accepted Answer

Nameservers point your domain to your web server. Misconfigured nameservers can make your website unreachable.

Question 45

Why would I want to know what technology my site uses?

Accepted Answer

It helps identify known vulnerabilities, plan updates, and understand your attack surface.

Question 46

Which CMS systems do you detect?

Accepted Answer

We identify WordPress, Drupal, Joomla, Magento, Shopify, Wix, and many others.

Question 47

Can you detect JavaScript frameworks?

Accepted Answer

Yes, we identify React, Angular, Vue.js, Next.js, and other frameworks.

Question 48

What is a CDN and why do you identify it?

Accepted Answer

CDNs like Cloudflare deliver content quickly. We identify them to understand your infrastructure.

Question 49

What is continuous monitoring?

Accepted Answer

Automated security checks that run on a schedule. Daily on Starter; on Professional and Enterprise you choose the interval yourself.

Question 50

How often is my website monitored?

Accepted Answer

Trial: no scheduled monitoring, you run the audits yourself. Starter: daily. Professional and Enterprise: you choose, with uptime checks from every 5 minutes to every other day and full scans from every 3 hours to once a week.

Question 51

Which notification channels do you support?

Accepted Answer

Email, Slack and notifications in the app. On Enterprise also webhooks to your own systems.

Question 52

Can I customize notification thresholds?

Accepted Answer

Yes, you can set which severity levels (critical, high, medium) trigger notifications.

Question 53

What is Google Insights in FortifyNet?

Accepted Answer

Google Insights connects your Google Analytics 4 and Search Console with FortifyNet to combine security data with traffic and search performance.

Question 54

Which plan is required for Google Insights?

Accepted Answer

Google Insights is available on the Professional plan and above.

Question 55

How do I connect my Google account?

Accepted Answer

Go to your domain detail page and click "Connect Google". Sign in with your Google account and select which properties to link.

Question 56

Is it safe to connect my Google account?

Accepted Answer

Yes, we use Google's official OAuth2 flow. We only store access tokens, never your password. You can disconnect at any time.

Question 57

What AI insights are generated?

Accepted Answer

Our AI engine correlates security issues with traffic and search performance, providing actionable recommendations prioritized by business impact.

Question 58

What's included in the free trial?

Accepted Answer

14 days without a credit card, with the features listed for Trial: 1 domain, 10 audits, 5 test types, and complete reports.

Question 59

What's the difference between Starter and Professional?

Accepted Answer

Professional includes all 9 test types, Google Analytics & GSC integration, AI insights, your own monitoring intervals, API access, White-label reports, and priority support. Starter has 7 test types and daily monitoring.

Question 60

Can I connect FortifyNet to Claude or ChatGPT?

Accepted Answer

Yes. On Professional or Enterprise you connect your AI assistant under Settings, AI assistant. You can then ask it to audit your domains, read reports and follow uptime and alerts right in the chat. The assistant signs in as you and cannot add or remove domains, change settings or see payment details.

Question 61

Can I change plans at any time?

Accepted Answer

You can upgrade at any time from the pricing page; contact us to change or cancel your plan.

Question 62

What happens when the trial expires?

Accepted Answer

You can upgrade to a paid plan. If you don't upgrade, your data is kept but you can't run new audits.

Question 63

Do you offer annual discounts?

Accepted Answer

Contact us for annual plans with discounts, especially for Enterprise customers.

Question 64

What are organizations in FortifyNet?

Accepted Answer

Organizations let you separate domains and data per client or business unit. Perfect for MSPs and agencies.

Frequently Asked Questions

General