NicoServe / Capability index

NicoServe.
Security, explained.

Chat about your website security in natural language. Understand what your scans found and what to do next, with daily security scans, five-minute uptime checks, automatic outage alerts, guided fixes and safe pen testing. Prioritise your fleet, track score trends and share executive PDF reports. One plan, everything included.

Back to overview

01Fleet & reporting

Prioritise the estate. Report the progress.

Move from individual websites to a fleet-wide view of risk, availability and recent work. Included in the same plan, with no separate enterprise tier.

  • Risk-first fleet dashboard

    Find the assets that need attention without working through every site.

    • Estate security rating, critical/high findings and open incidents
    • 30-day expiry horizon and 24-hour fleet availability
    • Search, risk and verification filters, category filters and sorting
    • Asset table with scores, issues, uptime, expiry and last scan
    • Direct access to asset details and rescan actions

  • Executive PDF reports

    Download a concise security snapshot to share with your team or clients.

    • Current posture, open threats and asset inventory
    • 30-day score trend, completed scans and completed fixes
    • 24-hour availability and certificate/domain expiry countdowns
    • Covers assets visible to your signed-in account
    • Unknown data stays explicit; not a compliance certification

  • Score trends & activity history

    Follow security changes and the work behind them over the last 30 days.

    • Latest-known score trends with scored-asset coverage
    • Filter activity by scans, remediation or incidents
    • Timestamped records linking to asset or incident details
    • Incident timeline events and current remediation states
    • Activity history, not an immutable audit log

02Always on

Security checked daily. Uptime every five minutes.

Daily security scans cover your certificate, DNS and email records. Independent uptime checks watch your verified website every five minutes, with incidents and alerts when an outage is confirmed.

  • Website uptime monitoring

    Track whether your verified website is responding, separately from its security score.

    • Automatic HTTPS checks every 5 minutes
    • 24-hour and 30-day availability history
    • Response-time graph and recent check results
    • Inconclusive checks stay unknown, not falsely down

  • Wall view for offices & NOCs

    A high-level status board of every asset in your workspace, built for shared office displays and network operations centres.

    • Colour-coded status with problem assets shown first
    • Security scores, 24-hour uptime and average response times
    • Last check times, open incident counts and workspace totals
    • Refreshes every minute; uptime probes still run every 5 minutes
    • Full-screen option and direct access to each asset's details
    • Included in your plan; signed-in workspace access required

  • Daily website checks

    Track the basics that quietly break.

    • Availability and response status
    • HTTPS and redirect chains
    • Security headers

  • Preventative monitoring

    Catch the problems that cause real damage before visitors notice.

    • Leaked files — .env, .git, database dumps and config backups
    • Only reported when the file contents look real
    • Defacement detection for "hacked by…" pages
    • Alerts when your homepage redirects to another domain
    • Critical issues open incidents automatically

  • SSL & domain expiry countdowns

    Never lose a certificate or domain name to a missed renewal.

    • SSL certificate and domain registration expiry tracking
    • Escalating alerts at 30, 14, 7 days and 48 hours
    • Expired certificates or domains raised as critical
    • Chain health and clear status when a check can't run

  • DNS & domain records

    See how your domain is set up and what's missing.

    • Live DNS records viewer — A, AAAA, CNAME, MX, TXT, NS, CAA and SOA with TTLs
    • Filter, search and one-click copy for every record
    • DNSSEC status — is your DNS trust chain signed and published
    • CAA policy checks — who is allowed to issue certificates for you
    • Works for parked and email-only domains
    • Findings kept even if a check can't run

  • Email authentication

    Spot the gaps that let anyone spoof mail from your domain.

    • SPF, DKIM and DMARC checks
    • Copy-ready fixes for each record

  • Domain reputation

    Check whether your domain appears in malware reporting.

    • Daily and on-demand URLhaus checks
    • Raw evidence for every result
    • Listings stay open until a fresh check clears them

  • Subdomain discovery

    Find the hosts you forgot about.

    • Certificate Transparency and live DNS lookups
    • Dangling DNS and takeover risk flags
    • Expandable raw evidence for every verdict

03AI companion

Talk through your security, in your own words

Your built-in AI Security Analyst helps you understand your scores and findings, ask follow-up questions, and choose a sensible next step using your workspace data.

  • Security score

    One score with a weighted breakdown by category — website, SSL, domain/DNS and email.

    • Category weighting you can see
    • Updates after every scan

  • Findings with evidence

    Every issue shows its severity, the raw evidence and what it means.

    • Step-by-step fixes
    • Kept open until a scan confirms a change

  • AI security companion

    Ask naturally about your website security, then keep the conversation going.

    • Explain scores, scans and open findings
    • Follow-up questions in the same conversation
    • Practical advice grounded in available workspace data
    • Recommends next steps without changing your site

  • Weekly summary report

    A recurring view of what changed, what's open and what improved.

    • Delivered to your notification centre and email

04Fix & recover

Fix with a safety net

Every fix is guided, verified and reversible — you stay in control of what changes.

  • Guided fixes

    Copy-ready DNS and server changes you apply at your own provider.

    • Exact record values to paste
    • Marked done only after verification

  • Snapshots & rollback

    A snapshot before every fix, so you can always step back.

    • Compare any snapshot to live
    • Roll back in one click
    • Delete snapshots you no longer need

  • Safe Autopilot

    For SPF, DMARC and DKIM records, NicoServe can run the whole loop for you.

    • Auto-snapshot before the change
    • Auto-approve, apply and verify
    • Notified when it's done

  • Post-fix verification

    After every change, a re-scan confirms it worked before the finding closes.

    • Verification attempts tracked
    • Nothing closes silently

05Testing & alerts

Test safely. Hear about it fast.

On-demand exposure checks on verified sites, alerts you can tune, and protection on your own account.

  • Safe pen testing

    Read-only checks for publicly visible exposures, when you choose.

    • 8 checks: exposed files, admin pages, directory listing, versions, cookies, CORS, HTTP methods, page resources
    • Consent-first on verified sites, up to 60 requests
    • Printable report with evidence and fixes

  • Automatic outage response

    From confirmed downtime to recovery, the incident timeline updates automatically.

    • Repeated failures confirm an outage before an incident opens
    • Outage and recovery alerts in-app, in Slack or via signed webhooks
    • Detection, acknowledgement and recovery in one timeline
    • Uptime incidents close only after confirmed recovery

  • Notification centre

    One place for everything that needs your attention.

    • Separate personal delivery preferences and event choices
    • Findings, incidents and uptime, fixes, verification and account events
    • Workspace channels remain independent of personal preferences

  • Slack alerts

    Bring security and uptime events into your team’s Slack channel.

    • Connect a Slack incoming webhook
    • All severities, high & critical, or critical only
    • Recovery notices included at every threshold
    • Links to the relevant asset or incident

  • Signed custom webhooks

    Send security events to your own HTTPS tools with verifiable signatures.

    • HMAC-SHA256 signed JSON events
    • Encrypted endpoint and signing credentials
    • Send test alerts and review the latest delivery status
    • Automatic retries with manual retry for failures
    • Up to 5 channels per workspace; owner/admin managed

  • Account protection

    Eyes on your own sign-ins too.

    • Sign-in and new-device alerts
    • Password-change notices
    • Temporary lockout after repeated failed attempts

Meet your AI security companion.

Connect your website, ask your first security question, and get clarity on what to do next. Monitoring, natural-language chat and guided fixes. Every feature included.

Protect My WebsiteSee How It Works

Natural-language chat · Daily checks · Guided fixes

Protect My Website