WarDek is the security + compliance cockpit for European SMEs. It helps you see what exposes your site, prove your compliance level, and fix concrete issues.

Is my company subject to NIS2?

The NIS2 directive applies to essential and important entities in sectors such as energy, healthcare, transport, digital, etc. Use our free simulator to check.

How should I use WarDek reports in an audit?

WarDek reports provide a practical working base for your team, auditor, or compliance preparation. They are not an official certification or legal opinion.

How long does a scan take?

A full scan usually takes under a minute: about 10 seconds on the free tier, up to 30 seconds with active scanning. A slow or very large site may take longer.

Absolutely. We never store your credentials. Reports are encrypted and you can delete them at any time. We are hosted in France.

Can I try before I buy?

Yes! The Free plan lets you test WarDek with 3 scans per month, no credit card required.

Does WarDek replace a pentester?

No, WarDek automates baseline checks (OWASP Top 10, headers, SSL, compliance). For in-depth penetration testing with manual intrusion tests, consult a certified expert.

Does WarDek provide an official certification?

No. WarDek is a self-assessment, prioritization, and audit-preparation product. It helps structure evidence and next actions without replacing an accredited audit or legal advice.

Is the WarDek scan intrusive on my infrastructure?

No. Tier 1 (Free/Pro) is 100% passive: it analyzes your public surface (DNS, headers, SSL/TLS, exposed files) without sending payloads. Tier 2 (Compliance+) runs active modules (nmap, nikto, testssl) only after your explicit authorization on assets you have validated. No load on your cloud quotas, no impact on production.

How does WarDek integrate with our CI/CD?

Compliance+ plan: REST API + webhooks to trigger a scan on every deployment, export findings as JSON/SARIF, and block a merge if the compliance score drops below your threshold. Compatible with GitHub Actions, GitLab CI, Jenkins. Developer docs at /developers.

const scanResult = await wardek.scan(url)

if (result.severity === "CRITICAL") { alert(result) }

const headers = await checkSecurityHeaders(domain)

const tlsGrade = await validateCertificate(host)

const nis2Score = computeCompliance(assessments)

export async function runTier1Scan(target: string)

const findings = results.filter(r => r.score < 80)

await db.scan.create({ data: { url, score, findings } })

const vulnerabilities = await scanOWASPTop10(url)

const posture = summarizeRisk(findings, frameworks)

const sslExpiry = cert.validTo.getTime() - Date.now()

const aiActRisk = classifyAISystem(systemDescription)

const dnsRecords = await checkSPF_DMARC_DKIM(domain)

const cookies = parseCookieFlags(setCookieHeader)

const compliance = mapToFrameworks(findings)

const evidence = await buildAuditTrail(scanId)

logger.info({ action: "scan-complete", url, score })

return { score, grade, findings, compliance }

const rgpd = await auditDataProcessing(company)

const report = await generatePDFReport(scanId)

const scanResult = await wardek.scan(url)

if (result.severity === "CRITICAL") { alert(result) }

const headers = await checkSecurityHeaders(domain)

const tlsGrade = await validateCertificate(host)

const nis2Score = computeCompliance(assessments)

export async function runTier1Scan(target: string)

const findings = results.filter(r => r.score < 80)

await db.scan.create({ data: { url, score, findings } })

const vulnerabilities = await scanOWASPTop10(url)

const posture = summarizeRisk(findings, frameworks)

const sslExpiry = cert.validTo.getTime() - Date.now()

const aiActRisk = classifyAISystem(systemDescription)

const dnsRecords = await checkSPF_DMARC_DKIM(domain)

const cookies = parseCookieFlags(setCookieHeader)

const compliance = mapToFrameworks(findings)

const evidence = await buildAuditTrail(scanId)

logger.info({ action: "scan-complete", url, score })

return { score, grade, findings, compliance }

const rgpd = await auditDataProcessing(company)

const report = await generatePDFReport(scanId)

const sslExpiry = cert.validTo.getTime() - Date.now()

const aiActRisk = classifyAISystem(systemDescription)

const dnsRecords = await checkSPF_DMARC_DKIM(domain)

const cookies = parseCookieFlags(setCookieHeader)

const compliance = mapToFrameworks(findings)

const evidence = await buildAuditTrail(scanId)

logger.info({ action: "scan-complete", url, score })

return { score, grade, findings, compliance }

const rgpd = await auditDataProcessing(company)

const report = await generatePDFReport(scanId)

const scanResult = await wardek.scan(url)

if (result.severity === "CRITICAL") { alert(result) }

const headers = await checkSecurityHeaders(domain)

const tlsGrade = await validateCertificate(host)

const nis2Score = computeCompliance(assessments)

export async function runTier1Scan(target: string)

const findings = results.filter(r => r.score < 80)

await db.scan.create({ data: { url, score, findings } })

const vulnerabilities = await scanOWASPTop10(url)

const posture = summarizeRisk(findings, frameworks)

const sslExpiry = cert.validTo.getTime() - Date.now()

const aiActRisk = classifyAISystem(systemDescription)

const dnsRecords = await checkSPF_DMARC_DKIM(domain)

const cookies = parseCookieFlags(setCookieHeader)

const compliance = mapToFrameworks(findings)

const evidence = await buildAuditTrail(scanId)

logger.info({ action: "scan-complete", url, score })

return { score, grade, findings, compliance }

const rgpd = await auditDataProcessing(company)

const report = await generatePDFReport(scanId)

const scanResult = await wardek.scan(url)

if (result.severity === "CRITICAL") { alert(result) }

const headers = await checkSecurityHeaders(domain)

const tlsGrade = await validateCertificate(host)

const nis2Score = computeCompliance(assessments)

export async function runTier1Scan(target: string)

const findings = results.filter(r => r.score < 80)

await db.scan.create({ data: { url, score, findings } })

const vulnerabilities = await scanOWASPTop10(url)

const posture = summarizeRisk(findings, frameworks)

CYBERSECURITY & COMPLIANCE

What an attacker sees.What your client demands.

The free scan shows what is visible from the outside, what it exposes, and where to start. Then the report you hand to your client — NIS2, GDPR, AI Act.

22

analysis modules

< 1min

results

NIS2 · RGPD · AI Act

frameworks covered

FR / EU

FR / EU hosting

Start my free audit See a demo →

No credit card — under a minute

SECURITY POSTURETO STRENGTHEN

3 points to fix — last scan 14:31

CLASSIFIED

78

/ 100

Security Score

Security Headers

87%

SSL / TLS

95%

NIS2 Compliance

91%

Vulnerabilities

62%

Active Findings3 to fix

Incomplete security headers on the login pageHigh

Configuration file publicly accessibleHigh

Connection not forced to HTTPS (to fix)High

Outdated encryption to updateMedium

View full report →OPERATIONAL

Built for European teams

Team based in France

Hosted in EU

22 scan modules

6 compliance frameworks

GDPR & CNIL compliant

Audit < 1 minute

Built for your role

One dashboard, with evidence and actions tailored to your role

CISO / CTO

“My board is asking for a security assessment”

Professional PDF report in under a minute, 0-100 score, prioritised action plan

DPO

“I need to prove GDPR compliance for the regulator audit”

Article 30 register, DPIA, pre-filled documentation

Developer / Freelancer

“My client is asking if their site is secure”

Quick audit to include in client deliverables

SME Director

“NIS2 requires me to do something but I don't know what”

Interactive checklist without jargon, concrete actions

How it works

Two paths depending on your role

Technical Path

CTO / Developer / DevOps

Enter your URL

Type your website or API address

See the gaps

Headers, SSL, injections, cookies, CORS, ports, DNS, emails, exposed files...

Prioritize fixes

Overall score + recommendations prioritized by severity

PDF Report

Professional export for your team and audits

Compliance Path

DPO / CISO / Management

Choose a framework

NIS2, GDPR, AI Act or all three

Guided checklist

Simple questions, no technical jargon

Compliance score

Visualize your level and gaps

Audit report

Compliant PDF for statutory auditors and regulators

Regulatory alert

Why act now?

Regulatory deadlines don't wait

NIS2

NIS2

National transposition under way (EU deadline: Oct. 2024)

Fines of up to €10M or 2% of turnover expected

Many SMEs are not yet prepared

Directive (EU) 2022/2555

GDPR

GDPR

In force

Up to €20M or 4 % of global annual turnover

≈ €6.1B in cumulative fines across Europe since 2018

GDPR Enforcement Tracker (CMS), 2026

AI Act

AI Act

Bans applicable since Feb. 2025

Up to €35M or 7% of turnover

AI governance often missing

Regulation (EU) 2024/1689

DÉMO EN DIRECT

Try WarDek now

Enter a URL and get a preview of your security score in 30 seconds.

See. Prove. Fix.

The security + compliance cockpit for European SMEs, with concrete output instead of vague promises.

See what exposes you

WarDek analyzes your public web surface: headers, SSL/TLS, DNS, email, exposed files, CVE clues, WAF, CMS, AI exposure, LLM checks and more.

22 modules | 300+ checks | < 1 min

Compliance Plan

Prove your level

NIS2, GDPR, AI Act, PCI-DSS, ISO 27001 and SOC 2. A single scan auto-assesses 6 frameworks. Checklists, scoring, scan bridges and exportable evidence.

8 modules | 6 frameworks auto | 1 scan

Pro Plan

Fix concrete issues

Prioritized action plans, PDF reports, stack-specific remediation snippets, and score history help you move from findings to execution.

Actionable fixes | PDF | Score history

Why WarDek?

Compare the scan, proof, and compliance surfaces that matter to a European SME

Feature	WarDek	Qualys	SecurityHeaders	Mozilla Obs.	Tenable	Pentest-Tools
Price	€0-199/mo	$500/mo	Free	Free	Custom pricing	$79/mo
Results in	<1 minute	5-30 minutes	<5 seconds	<10 seconds	30+ minutes	5-20 minutes
Core features
OWASP Scanner			~	~
NIS2 Compliance
GDPR Module
AI Act Compliance
French interface
PDF Reports
REST API
Advanced security coverage
HSTS Preload Status			~	~
security.txt Detection
Subresource Integrity (SRI)			~
Cipher Suite Analysis						~
CMS Detection
WAF Detection					~
OWASP LLM Top10

ECOSYSTEM

Pair with the tools you already trust

WarDek covers EU compliance. They handle deep pentest. Use them together for full coverage.

Burp Suite

Manual pentest

OWASP ZAP

Active scanning

Nuclei

CVE templates

WarDek + your favorite scanner = compliance proof + offensive depth.

Security Blog

Latest Security Insights

Expert guides on web security, compliance, and best practices.

See all articles

Guides

Security Checklist Before Production Deployment: 25 Points

25-point security checklist before deploying to production. Infrastructure, application, authentication, data protection, and monitoring controls.

#security#deployment#checklist

18 avril 20269 min

Guides

How to Secure Your Website Quickly: 10 Practical Steps

A prioritized 10-step checklist to secure your website fast — from HTTPS and security headers to input validation, backups, and continuous monitoring.

#security-checklist#web-security#https

16 avril 20267 min

Conformité

AI Compliance Audit: 20-Point EU AI Act Checklist

AI audit checklist for EU AI Act compliance. AI inventory, risk classification, 20 control points, documentation requirements, and ongoing monitoring.

#AI Act#audit#compliance checklist

14 avril 20268 min

Transparent pricing

Clear plans for human-operated and machine-readable usage, without hype-driven overpromises.

Free

Ideal for a first audit

€0

On-demand scans only
3 OWASP scans per month
1 PDF report per month
Community support

Security

14-day trial

Continuous monitoring of one domain, without the compliance layer

€79/per month

1 monitored domain · unlimited scans
Custom PDF reports
Stack-specific remediation snippets
Score history
Priority email support

Popular

Compliance

Full compliance from a single domain

€199/per month

3 monitored domains · unlimited scans
8 compliance modules (NIS2, GDPR, AI Act, PCI-DSS, ISO 27001, SOC 2, DPIA, Rights)
Scan bridge → 6 frameworks auto
Unlimited scheduled scans
Audit reports for CAC
Phone support

Group & Agency

Agencies, groups and multi-brand portfolios

On request

Domain scope defined with you
Everything in Compliance +
API keys + public REST API v1
Enterprise webhooks
API-first CI/CD automation (GitHub Action + SARIF)
White-label
Priority support

FAQ

Frequently asked questions

Everything you need to know about WarDek

Have more questions?

ÉVALUATION GRATUITE

Less theatre. More security decisions.

Run a free scan and leave with a score, priorities, and a usable proof base.

Start my free audit