ShieldWave: Website Security Scans in Plain Language for Non-Technical Owners

ShieldWave scans any website externally, the way an outside attacker would approach it, with no hosting credentials, no CMS login, and no code changes required. In roughly 90 seconds, the scanner checks more than 20 categories: SSL/TLS certificate validity and configuration, HTTP security headers (Content-Security-Policy, X-Frame-Options, HSTS), exposed backup files, outdated plugin versions visible from outside the site, malware indicators, DNS configuration, and email authentication records (SPF, DKIM, DMARC). The scanner also surfaces how findings compound each other: a misconfigured header combined with an exposed file path creates a weaker posture than either finding alone. That cross-finding context helps prioritize what to fix first rather than treating each item as an independent task. The scan is read-only and non-destructive; it observes only what is publicly visible and does not generate traffic that site visitors would notice. Domain confirmation is required on first scan, a one-step process that prevents scanning sites the user does not control. The free tier (5 scans/month on one site, no card required) returns a security score on a 0-100 scale and highlights the top three issues. The Pro plan unlocks the full report with every identified finding and its fix instructions.

Most security scanners produce a single document, typically a technical severity-ranked list written for a security professional. ShieldWave generates two outputs from the same scan data, and the separation is the core product insight. The plain-language report presents each finding in accessible terms: what the problem is, why it matters to the business (not the firewall), and what steps to take in priority order. The developer brief covers the same findings reformatted as actionable technical instructions, ready to forward to a contractor or in-house developer without additional explanation or translation. For small businesses and agencies, this eliminates a specific operational gap: the owner can read the plain-language report and make decisions from it; the developer receives a brief that needs no re-explanation. The same information reaches both audiences in the format each can act on, from a single scan run. The Pro plan adds scheduled scanning with email alerts, so changes in posture (a newly expired certificate, an exposed file after a deployment, a header misconfiguration introduced in a CMS update) trigger an alert rather than waiting for the next manual check.

External scanning covers what an attacker can see from outside the site. The ShieldWave WordPress plugin, published as Ensomedia Security in the official WordPress.org directory, covers the internal attack surface: files already on the server, malware embedded in themes or plugins, unauthorized login attempts, and known vulnerabilities in installed plugins. The plugin includes a malware scanner for WordPress files and an on-server configurable firewall with IP-level and country-level blocking rules, injection filtering, and executable-upload blocking. The vulnerability detection checks installed plugins against known CVE data and applies hardening rules to reduce the exposure window between public disclosure and a plugin being patched. The firewall runs at the WordPress layer rather than at the network edge, so it is not equivalent to a cloud WAF service like Cloudflare or Sucuri. Two-factor authentication and passkey support secure the WordPress admin login independently of the hosting provider's controls. The plugin is fully free with no usage cap and no account required to install it from WordPress.org. When both the external scanner and the plugin are active on the same site, the ShieldWave dashboard combines their findings into a single view. For non-WordPress sites, only external scanning applies; the plugin is WordPress-specific. Agencies managing a portfolio that includes non-WordPress sites (Webflow, Squarespace, custom-built) should factor this scope into how they plan coverage for those properties.

The feature most likely to be overlooked by users who find ShieldWave through WordPress security channels is the compliance mapping in the Enterprise plan. The $29/month tier generates PDF reports with findings mapped to six frameworks: PCI-DSS, ISO 27001, SOC 2, HIPAA, NIS2, and OWASP Top 10. For businesses responding to vendor security questionnaires, preparing for an ISO 27001 audit, or serving clients in regulated industries (healthcare, fintech, e-commerce with card transactions), the compliance-mapped output converts a routine security scan into a structured evidence document. One-off security assessment reports from freelance consultants typically run several hundred to over a thousand dollars per engagement; the Enterprise plan generates compliance-mapped PDFs from automated scans at $29/month for unlimited sites. A scope qualifier applies: the compliance reports reflect what automated external scanning can measure. They serve as supporting evidence within a broader compliance process and do not replace a full internal audit, gap assessment, or penetration test required for actual certification. ShieldWave itself makes this distinction clearly. The Enterprise tier also includes white-label report branding and up to 10 team members, which makes the compliance deliverable viable as a client-facing document for agencies without rebranding effort.

The strongest fit is freelancers and small digital agencies managing WordPress client sites. The 25-site Pro plan at $12/month, combined with scheduled scanning and the dual-output report format, provides a repeatable security workflow and a client-ready deliverable without engaging a dedicated security team. The developer brief format in particular fits the agency model where client communication and technical execution involve different people. Business owners running their own sites who want to understand their security posture before a launch, after a significant deployment, or following a suspected incident will find the free scanner tier (5 checks/month, score and top 3 issues) sufficient for initial assessment, and the fully free WordPress plugin useful for ongoing internal monitoring. The $9 one-time scan covers a deeper check without a recurring commitment. Agencies serving clients in regulated industries who face compliance questionnaires from enterprise customers, or who need to demonstrate security diligence for ISO 27001, SOC 2, or PCI-DSS purposes, will find the Enterprise compliance-mapped reports directly applicable as supporting documentation. The tool is not aimed at security professionals who work in raw technical output, penetration testing, or active exploit research. The plain-language framing and accessible reporting are positioned for operators and owners, not security engineers.