Estimate your audit

This audit maps and tests your exposed surface. It does not include a deep audit of each site found: for a custom application, add a web audit.

White box includes a source code review: more thorough, but significantly longer.

In black box with no public sign-up, the authenticated part is only tested without credentials, so very partially (for example by trying to reach endpoints that should require authentication). Grey box (accounts provided) is then strongly recommended for full coverage.

Enter 0 if no server is in scope.

Custom-built websites running on your servers are not audited in depth here: they require a dedicated web application audit.