How to run a scan, verify a workshop lab, use the member tools, and understand what we map your findings to.
Comptrusence is free to start. You can generate a QR code without an account at all. Everything else lives behind a free login, because the tools cost real compute.
Go to Sign up. No card required.
You land on the dashboard overview, with every member tool in the left sidebar.
Enter a URL in the Website Scanner. Results appear in minutes.
Our scans are passive, which means they behave like an ordinary visitor. Even so, only scan sites you own or are authorised to test. That is a condition of using the tools.
There are two tiers, and no paid plan is required for either right now.
| Access | What you get |
|---|---|
| Public | The QR code generator, and all of the marketing, workshop and documentation pages. |
| Free account | The full webinar library, the Website Scanner, and the breach, SSL/TLS and DNS tools. |
Your account is protected by a password that is never stored in plain text. All data is held in Australian data centres.
The scanner inspects a URL and reports findings mapped to the frameworks your auditor already asks about. It runs two profiles.
| Profile | What runs | Safe to run on any site? |
|---|---|---|
| Passive | Security headers, TLS, CORS, JWT, outdated client libraries, technology fingerprinting | Yes. Visitor-level requests only. |
| Design | SEO, screenshots at five device sizes, responsive layout, accessibility (WCAG 2.1 A and AA) | Yes. |
Each finding carries a severity, the check that produced it, a category, the affected target, and a plain-English fix.
The self-service scanner makes visitor-level requests only. It does not attempt to exploit anything, and it will not run at all until you confirm you are authorised to scan the target. Intrusive testing is a separate, contracted engagement with written authorisation.
| Tool | Input | What it tells you |
|---|---|---|
| SSL / TLS Checker | Hostname | Certificate issuer and expiry, protocol versions, weak ciphers, missing HSTS, and an overall grade. |
| DNS and Email Security | Domain | SPF, DKIM, DMARC, MX and DNSSEC posture, which is how easily someone can spoof your email. |
| Password Breach Check | A password | Whether that password appears in public breach corpora. Runs in your browser; only a partial hash is sent. No login needed. |
| QR Generator | Any link or text | A downloadable PNG. Runs entirely in your browser, nothing is uploaded. No login needed. |
Your browser hashes the password locally and sends only the first five characters of that hash. The password never leaves the page, and we never learn which one you asked about.
Raw findings are not much use to an auditor. Every finding we report is mapped to the frameworks Australian regulators and customers expect.
An automated scan is evidence, not certification. It does not replace an audit, a manual penetration test, or professional advice. Accessibility results are indicative and are not a legal conformance statement.
The portal is backed by a JSON API. A documented public API with tokens is on the roadmap. The shape below is what the portal itself uses.
# Start a passive scan POST /api/webscan { "url": "https://example.com.au", "profile": "passive", "consent": true } -> { "scan_id": "a1b2c3d4e5f6" } # Poll until state is done, then read the report GET /api/webscan/status/{scan_id} -> { "state": "running|done|error", "progress": { "done": 4, "total": 6, "current": "encryption" }, "report": { ... } }
Scheduled recurring scans with change alerts, PDF report export, team accounts, and API tokens. If one of these is blocking you, tell us and we will prioritise it.
Check the URL is reachable from the public internet, including the scheme. A site behind a VPN, an IP allow-list, or a login page will not be visible to a passive scan.
Automated tools produce false positives. Every finding includes the evidence we based it on, so you can judge it. If we got it wrong, tell us, because that feedback improves the engine.
Email admin@comptrusence.com or see Contact.