Why I Built ScanTower
As a security analyst, I see compromised websites daily. Hacked WordPress sites. Hijacked domains. Malicious scripts injected into legitimate businesses. The pattern is always the same: site owners have no idea anything is wrong until it's too late.
I run multiple websites and self-host several services. When you manage that many sites, you need a way to keep tabs on everything without logging into each one constantly. The problem? Existing security tools either miss critical issues or require so much setup that you never actually use them.
I needed something that would:
- Actually detect the issues that lead to breaches. Not just basic WordPress scans, but DNS hijacking, malicious scripts, SSL problems- -the real attack vectors.
- Work from the outside. No plugins to install, no server access needed. Scan sites the way attackers see them.
- Alert me when something changes. Domain configurations, new scripts, certificate expirations- -catch problems before they become incidents.
So I built ScanTower. It started as a tool for monitoring my own sites, but I realized other people probably had the same problem. If you run multiple sites, manage clients' websites, or just want to know your site hasn't been compromised, this is the tool I wish I'd had years ago.
Built in the Cotswolds, England. No VC funding. No sales pressure. Just a security professional who got tired of watching preventable breaches and built something better.
What Makes ScanTower Different
Features that matter, built from real experience
Real-World Attack Vectors
Scans for the actual techniques used in breaches - not just theoretical vulnerabilities. Built from observing real compromises.
Built by a Security Analyst
Created by someone who analyzes compromised sites daily and knows what indicators actually matter when detecting intrusions.
External Scanning
See your site the way attackers do - from the outside. No agent installations, no backend access needed.
Multi-Site Management
Built for managing multiple websites efficiently. Monitor everything from one dashboard without logging into each site.
How It Works
External scanning combined with threat intelligence from multiple sources- -the way security professionals actually investigate sites
Change Detection & Monitoring
Tracks modifications to your site over time - new scripts appearing, certificate changes, DNS updates. If something changes that shouldn't have, you'll know immediately.
Multi-Source Intelligence
Integrates with VirusTotal, Wordfence, WPScan, and other trusted vulnerability databases.
Headless Browser Scanning
Captures screenshots and analyzes all loaded scripts-detects card skimmers, malicious injections, and suspicious third-party resources that traditional scanners miss.
Domain Hijacking Detection
Tracks DNS records, nameserver changes, and domain registration status. Get alerts if your domain configuration changes unexpectedly-a common sign of hijacking.
Open About Our Approach
We use industry-standard vulnerability databases (WPScan API, Wordfence Intelligence, NVD), multiple malware detection engines (VirusTotal integration), and custom detection modules for configuration issues, DNS security, email authentication, and more. Everything runs in isolated cloud environments-we never install anything on your server.
Being Honest About Limitations
No security tool is perfect. Here's what we can and can't do.
What We Do Well
- •Detect known vulnerabilities across WordPress, plugins, themes, and core CMS platforms
- •Identify malicious scripts and suspicious third-party resources
- •Monitor DNS, SSL/TLS, security headers, and email authentication
- •Scan without installing anything on your server
Current Limitations
- •Can't detect zero-day vulnerabilities or custom code issues
- •External scanning means we can't access password-protected areas
- •Some server configuration issues require backend access
- •Database vulnerabilities require internal scanning tools
The Bottom Line: ScanTower is excellent for continuous external monitoring and detecting the issues that cause most breaches. For comprehensive security, combine it with a Web Application Firewall (WAF) and regular internal audits.
Built on Trust & Transparency
Your Data is Safe
We only collect scan results and metadata needed to provide the service. Your data is encrypted at rest and in transit. We never sell your information to third parties.
No Hidden Costs
Clear, upfront pricing. No surprise charges. No dark patterns. If something changes, we'll tell you first. Start with a free scan-no credit card required.
Built for Real Use
I use ScanTower to monitor my own sites every day. Features are added based on actual security incidents I've observed, not marketing trends or investor demands.
Detectors Based on Real Attacks
When I see a new attack pattern in the wild, I add detection for it. The scanner evolves based on actual threats, not theoretical vulnerabilities from outdated security guides.
Built in the Cotswolds, England by someone who got tired of watching preventable security incidents. If you have feedback, spotted an issue we should detect, or want to chat about web security, get in touch.