We find the bugs on your website before others do.

We check what is publicly accessible from the outside: the technical security of your website and, purely formally, the mandatory information in the legal notice and privacy policy.

The Basic Check and the free short check only look at significant points that can be clearly measured from the outside: an invalid certificate, unencrypted pages or forms, Google Fonts and third-party services before consent, a missing legal notice or missing privacy policy, and software with a known critical security vulnerability. The Full Check additionally checks in detail: security settings, cookies and consent banners in a real browser, the mandatory content of the legal notice and privacy policy (formally), accessibility, loading time, search engines, AI visibility and email security (SPF, DKIM, DMARC).

Monthly, for as long as your subscription runs. More often if you wish.

This applies to the Basic Check and the Full Check. We agree a shorter check interval with you in the offer.

You receive a clear message explaining what we have found and how urgent it is.

With the Basic Check, we only get in touch if there is a significant finding. With the Full Check, you also receive the PDF report with a traffic-light rating. Implementation is up to you or your service provider; if you wish, we can help through Consulting.

No.

We only check what is publicly accessible: without logging in, without any intervention in your website and without attack or load tests. PlugTheBug is therefore not a substitute for a penetration test.

No. We check legal texts only formally, e.g. whether mandatory information is present and accessible.

We do not carry out a legal assessment of the individual case, and we do not draft legal texts. Legal questions are best clarified with a lawyer.

The reports are a snapshot at the time of the check and do not claim to be complete. They are created with the help of AI. Not legal advice.

A website can change at any time. That is why we check regularly instead of looking just once.

An address on the checked domain, or the address given in the website's legal notice or security.txt.

This ensures that findings only reach authorised persons. In other cases, we ask for proof of authorisation before sending.

For businesses based in Germany.

Especially for small and medium-sized businesses whose management does not have its own IT department to rely on. We do not enter into contracts with consumers.

Yes. The Basic Check and the Full Check each include one domain. Each additional domain costs a surcharge that decreases with every domain; the price calculator shows the exact monthly price.

You can enter up to 50 domains via the form; more domains on request. All domains are covered by one contract with a single monthly price. Go to the price calculator

No. The short check, with the scope of the Basic Check, is free of charge; a subscription for regular checks only comes into being when you accept our offer by email.

After submitting the form, you first confirm your email address. You then receive an offer from us that you can review at your leisure.

Monthly, in text form. An email is sufficient.

The notice period and details are set out in our Terms and Conditions. Terms and Conditions § 7: Term and termination

We noticed significant security findings on your website and have notified you about them once.

The email is not advertising. Where your address comes from, how to get a free re-check and how to object to further notices is explained on a separate page. More about the notice email