A free AI penetration test for your website
For small businesses, non-profits and community organisations anywhere that can't afford a professional security test. Our AI agent tests your website the way an attacker would, and our volunteer cybersecurity specialists check every finding before you get a plain-language report on what to fix first.
- Free of charge, run by a volunteer non-profit
- Only with your written permission
- Results stay confidential
Request your free test
We reply within a few days. Nothing is tested until you've signed off on the scope.
What we look for
The weaknesses attackers most often use against small organisations' websites.
Outdated software
Old versions of your CMS, plugins or server software with known, published vulnerabilities.
Risky configuration
Admin panels open to the internet, debug pages, directory listings and missing security headers.
Common web attacks
Injection, cross-site scripting and broken access control: the flaws attackers try first.
Exposed files
Backups, configuration files or passwords accidentally left where anyone can download them.
Login security
Login pages without protection against password guessing, and weak password-reset flows.
Verified results only
Our volunteer cybersecurity specialists check every finding by hand, so your report has no false alarms.
What you get
A report written for the people who run your website, not for security specialists.
- Every issue ranked by severity, so you know what to fix first
- A plain-language explanation of what each issue means for your organisation
- Concrete steps to fix each issue, or what to ask your web developer or host
- Only verified findings: no automated noise and no false alarms
- A call with a volunteer to go through the results and answer your questions
How it works
Four steps, and you stay in control of every one. We never test a website without written permission from its owner.
- 01
Request
Fill in the form. It takes about two minutes.
- 02
Agree the scope
We email you to agree what we test and when. You sign a one-page permission agreement, and we confirm your organisation controls the website.
- 03
Test
At the agreed time, our AI agent tests your website remotely under the supervision of our volunteer cybersecurity specialists. We avoid anything that could change or delete your data.
- 04
Report
You get a plain-language report that ranks each issue by severity and explains how to fix it, and we go through it with you.
Why is it free?
MaaSec is a volunteer-run cybersecurity non-profit association from Maastricht, the Netherlands, helping small organisations everywhere.
Our volunteer cybersecurity specialists provide free security assessments, advice and awareness training. All income is reinvested in our activities and is not distributed to members.
Questions
What is an AI penetration test?
A penetration test is an authorised, simulated attack on your website, done to find weaknesses before real attackers do. We use AI agents to run many of those checks quickly, and our volunteers review every result, so you only receive real, verified findings.
Is it really free?
Yes. MaaSec is a non-profit association run by volunteers. All of our income is reinvested in our activities and none of it goes to members. There's no fee, and you're under no obligation afterwards.
You're based in the Netherlands. Can you test my website?
Yes. A penetration test of a website is done remotely over the internet, so it doesn't matter where you are. We only start once whoever owns the website has given us written permission.
How long does it take?
We're volunteers, so we handle requests in the order they arrive. After you send the form we email you to agree the scope and schedule the test. How soon that is depends on how many requests are waiting, and we'll tell you honestly when we email.
Could the test break my website?
We test at a time you choose, stay within the scope you approve, and avoid tests that change or delete data. If something looks risky, we stop and ask you first.
Who can apply?
Small businesses, non-profits, charities, clubs and community organisations anywhere in the world that can't afford a professional security test.
What do you need from us?
Your website address, someone who can sign the permission agreement on behalf of your organisation, and time for a short call to go through the results.
Who sees the results?
Only you and the volunteers working on your test. We never publish findings or share them with anyone else.
Find out how your website holds up
Free, confidential, and only with your permission.
Request your free test