Fluint scans your site for weaknesses, watches it around the clock and can stand in front of it as a firewall. Every finding comes with the exact fix, and nothing gets blocked until you say so.
Paste your address and Fluint checks everything the outside world can see. When you want real-time protection, drop one file in front of your site. You can switch any time.
An outside-in check of your live site with a clear A+ to F grade.
Everything in Frontend, plus a lightweight agent that sits in front of your site.
Fluintnode fluint-agent.js --server https://fluint.win --key fla_… --upstream http://127.0.0.1:8081 --port 80From the certificate on the front door to the firewall behind it, in one dashboard that works the same on your phone and your desktop.
A full outside-in scan of HTTPS, headers, software, exposed files and DNS, and every finding tells you exactly how to fix it. Mark it fixed, or keep it and accept the risk.
Eight categories rolled into a single score you can track over time.
Catches SQL injection, XSS, path traversal, command injection and Log4Shell, SSRF, secret-file probes and known attack tools.
Per-IP rate limits with automatic surge detection, brute-force login protection and auto-bans for vulnerability scanners.
New IPs pass an "I'm not a robot" check, built in or with Cloudflare Turnstile. Run it always or only during a surge. Search engines still get through.
Requests, unique visitors, countries, pages, referrers, browsers, devices, bots, status codes, bandwidth, top IPs and top attackers. No cookies and no fingerprinting.
One tap puts up a maintenance page for everyone except your allow-listed IPs. Turn it off when the coast is clear.
Checks every few minutes, tracks response time and warns you well before your HTTPS certificate expires.
Fluint fingerprints your homepage and tells you the moment a new third-party script or hacker text appears.
Attacks, downtime, new vulnerabilities and sign-ins go straight to your Discord or Slack.
Finds API keys in your HTML and JavaScript, and checks for public .git folders, .env files, database dumps, backups and logs.
Flags vulnerable JavaScript libraries, old WordPress core, plugins and themes, end-of-life PHP and compromised CDNs like polyfill.io.
Checks SPF and DMARC so nobody can send convincing email pretending to be your domain.
Every shield rule starts in warn me mode. When an attack shows up, Fluint opens an incident with one-tap answers like Block SQL injection, Block this IP or Keep as is. Prefer to set it and forget it? Pick a preset.
Watch and warn only. You decide on every incident.
Paste your address. The first scan starts right away and you get a grade in about a minute.
Add a meta tag, a small file or a DNS record. Verified sites unlock the deep checks, so nobody can use Fluint to probe a site they don't own.
Copy-paste fixes for Nginx, Apache, Node, PHP and DNS, or install the shield and fix things with one click.
A security tool you can't trust is worse than none, so Fluint is locked down by default.
Every account sets up an authenticator app before it can do anything, with 10 single-use backup codes.
scrypt-hashed passwords, lockout after repeated failures, and codes that can't be replayed.
Authenticator secrets are sealed with AES-256-GCM.
A device list with remote sign-out, a full activity log and an alert on every new sign-in.
Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; connect-src 'self'; font-src 'self'; manifest-src 'self'; worker-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'self'; object-src 'none'
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Referrer-Policy: no-referrer
Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=()
Cross-Origin-Opener-Policy: same-originNo third-party scripts, fonts or trackers anywhere on fluint.win.
Nothing. Create an account, turn on 2FA and add your sites. There's no card to enter and no trial timer.
No. Frontend security only needs your address. The optional shield is a single Node.js file with no dependencies that runs in front of your site as a reverse proxy, and the dashboard writes the exact install command for you.
Not unless you ask it to. Every rule starts in warn mode and Fluint asks you before blocking anything. If you turn on the visitor captcha, people who pass are remembered for days and verified search-engine crawlers are let straight through.
Only for the same public checks any browser could do. The deeper checks, like probing for exposed files, only run after the owner proves they control the site with a meta tag, file or DNS record.
The shield stops application-level floods, bad bots and password guessing. Very large network-level attacks have to be absorbed before they reach your server, for example by Cloudflare's free plan. Fluint checks for this and tells you if you don't have it.
For your traffic stats Fluint stores each request's path, status, IP address, country and user agent, and deletes them after 30 days. The stats snippet sets no cookies and doesn't fingerprint visitors. Authenticator secrets are encrypted, and passwords are only ever stored as hashes.
Yes. The dashboard is built for phones first and can be installed to your home screen like an app, in light or dark mode.
Your first scan takes about a minute.