Free security check · no signup · 10 seconds

Find your weak spots before someone else does.

Attackers scan the internet for easy small businesses around the clock. Superlock shows you what they see about yours, in plain English, then keeps watch every day.

  • Read-only
  • Nothing to install
  • No email needed
Email impersonationSPF · DKIM · DMARCHTTPS & certificatesDomain transfer lockRenewal dateBrowser protectionsCard-skimming scriptsOutdated WordPressDNSSECEncrypted mail deliveryServer software leakssecurity.txt

Anatomy of a fake invoice

Scams start days before the money moves. That's when you want to know.

  1. Day 1 · 02:14
    Someone registers acme-bakerv.com

    One letter off from yours. Nobody at your business notices.

    SuperlockLookalike spotted

    Typo domains of yours are checked every few days.

  2. Day 3 · 19:40
    It gets mail servers

    Now it can send email that looks like it came from you.

    Superlock alert"A lookalike of your domain can send email"

    In Slack, Teams or your inbox, with what to tell customers today.

  3. Day 4 · 09:05
    Your customer gets an invoice

    "We've changed banks. Please pay the new account."

    SuperlockYour own domain is locked down

    One approved fix tells inboxes to reject email faking your real address.

  4. Without anyone watching
    You find out when the payment never arrives.

    US businesses reported over $3 billion lost to email fraud like this in 2025 (FBI IC3).

Illustrative scenario. Every Superlock step in it is a real check that runs today.

Check my domain nowFree, read-only, about 10 seconds.

The threat, by the numbers

Attacks got faster. Most small businesses didn't.

Primary sources only, labelled with what each number measures.

What Superlock watches

Everything a scammer looks at. Checked every day.

What anyone on the internet can see. Built in, from the moment you add your domain.

Email & domain

Whether anyone can send email as you, and an alert the moment your mail servers, SPF, DMARC or transfer lock change.

Website

Uptime every five minutes, certificates, browser protections, outdated WordPress, and every outside script your homepage loads.

Lookalike domains

Typo versions of your domain, and a loud alert when one sets up email: the opening move of invoice fraud.

Forgotten corners Verified domains

Subdomains that could be taken over, forgotten test sites, and leaked .git or .env files.

Holes in use today Verified domains

Remote desktop and databases left open, and software on CISA's list of actively exploited vulnerabilities.

Who sends as you Coming soon

Superlock reads your DMARC reports for you and flags any unknown sender.

Alerts go to
  • Email
  • Slack
  • Teams
  • Discord
  • Google Chat
  • Zapier
  • Make
  • Webhooks

How it works

A security team's habits. Without the security team.

  1. 01

    Scan

    Add your domain and connect what you use, read-only. Nothing to install.

  2. 02

    Approve

    Every fix says why it matters and exactly what will change. Nothing changes without your OK.

  3. 03

    Relax

    Superlock re-checks every day, verifies each fix, and only interrupts you when something real changes.

Needs your approvaltry it · sample

Stop scam emails that pretend to be you

Inboxes currently deliver email that fakes acme-bakery.com. Every real sender of yours already passes, so this is safe to tighten.

- v=DMARC1; p=none+ v=DMARC1; p=quarantine
Your weekly reportacme-bakery.com · Monday 8:00
41checks
2to look at
1fixed

Honest by design

Security you can check, from a company that shows its work.

Real findings only

No invented threats or fake countdowns. Every finding shows the record we saw, and the score is a published formula.

We say what we can't see

An outside check can't see your accounts or laptops. We tell you that, instead of selling a green checkmark.

Read-only until you say so

Connections use the narrowest access that works. Any change waits for your approval.

A record you can verify

Every check and change goes into a tamper-evident log you can export and verify yourself.

Pricing

One price for the whole business. No per-seat maths.

Everything is free during the beta. No card. Accounts that join now keep a founding price when paid plans start.

Try it now

Free scan

$0

What anyone on the internet can see about your business, right now.

  • Public checks across email, website and domain
  • Plain-English fixes
  • Shareable result link
Run a free scan
Free during beta

Watch

$49/month per business

Continuous outside-in monitoring for the busy owner.

  • Daily checks for up to 3 domains, uptime every 5 minutes
  • Alerts when records, certificates or scripts change
  • Lookalike-domain and attack-surface monitoring
  • Slack, Teams, Discord or email, plus a weekly report
  • Your whole team, with roles you control
Start free
Most complete · free during beta

Protect

$99/month per business

Everything in Watch, plus a look inside the accounts that run your business.

  • Microsoft 365 or Google Workspace checks
  • Stripe and Shopify: payout changes, card testing, risky orders
  • GitHub: leaked secrets and vulnerable code
  • Breach alerts for your team's addresses
  • AWS, Okta, Slack, 1Password and HubSpot, with Xero and QuickBooks coming soon
  • One-click DNS fixes
  • Insurance readiness and a shareable report
  • Up to 5 domains, and help from a human
Start free

Look after several businesses? .

Questions

The fine print, in large print.

Is the free scan safe to run?

Yes. It reads only what's already public: your domain's DNS records, the registry's public registration record, and a few ordinary page requests any browser makes (your homepage, its http:// redirect, and public security.txt and MTA-STS files). We don't log in, guess passwords, probe ports or test for exploits. Our requests identify themselves as SuperlockScan.

If my grade is an A, am I secure?

No, and we'll never claim that. An A means your public setup is in good shape. It can't tell you whether staff use 2-step login, whether a password has leaked or what your connected apps can reach. That's what connecting your business is for.

I already have an IT person or an MSP.

Great. Superlock gives you an independent, plain-English view of what's checked and what isn't, and gives them a prioritized list. You can invite them with their own role, at no extra cost.

What can Superlock change?

Only the DNS fixes you approve, through a DNS connection you create. Everything else is read-only: Superlock never reads the content of email or files and can't move money. Tokens and keys are stored encrypted, and you can revoke them at any time.

Is Superlock itself secure?

It has to be. Connections are read-only, Stripe keys must be restricted, tokens are encrypted, passwords and links are hashed, 2-step login is available to everyone and can be required for the whole team, and every request is checked against the person's role on the server. Details are on our security page.

Can my bookkeeper, IT provider or auditor have access?

Yes, with no per-seat charge. Pick a ready-made role (Admin, IT provider, Member, Bookkeeper, Viewer or Auditor) or build your own. Nobody can give access they don't have, and only an owner can delete the business.

What does it cost?

Nothing during the beta, and no card is needed. After the beta, Watch is $49 and Protect is $99 a month per business, and accounts that join now keep a founding price. You'll be told well before anything is charged.

Your business is online.
So are its weak spots.

Or create a free account and Superlock starts watching straight away.

Partners

Put a sentry on your clients.

For IT providers, agencies and anyone looking after several businesses. Tell us a little and we'll be in touch about partner pricing. Just want to protect your own business? Start free.

Team size
Interested in

We'll only use this to contact you about Superlock.