What it checks
Every way in a hostile agent would use, from the outside:
- Protected: secret files left public (.env, .git, backups, keys inside public scripts), security headers, login and signup forms with no bot guard
- Agent-safe: hidden text written to steer AI agents, and what an agent could do on your forms
Why AI agents change what "safe" means
Attacks used to need a person at a keyboard. Now an AI agent can try thousands of sites while its owner sleeps. On our own decoy files, a scanner took a fake AWS key and tried to make itself admin with it within three hours. The first thing these tools look for is a secret file someone forgot to hide, which is exactly what the check looks for.
How it compares with a malware scanner like Sucuri SiteCheck
Sucuri SiteCheck is a well-known free remote scanner. Sucuri says it checks for known malware, blacklisting, website errors, out-of-date software and malicious code, and that a remote scan cannot see server-side files.
AgentDecoy answers different questions: could an AI agent get in, and what would it find. Then its decoys catch whoever tries. They work well together. Run a malware scan to see whether you have already been hit, and AgentDecoy to see what attackers would find.
What happens after the check
You get a numbered fix list for your platform (WordPress, Shopify, Wix and others) with the exact place to change each thing, a shareable result, and optional done-for-you fixes with starting prices. Nothing is stored unless you ask for alerts or a report.
Questions
Is this website checker free?
Yes. The scan is free and stays free, up to ten scans an hour. Pro re-scans one site every week for $12 a month.
How do I check if my website is safe?
Run a free remote check like this one for exposed files, headers and forms, run a malware scanner to see whether anything bad is already on the site, keep your software updated, and keep backups.
Is AgentDecoy a Sucuri SiteCheck alternative?
It covers different ground. SiteCheck looks for malware and blacklisting. AgentDecoy looks at what AI agents and attack tools would find, and catches them with decoys. Many owners will want both.
Does the check touch or change my site?
No. It reads only what any visitor can see, the same way a browser does, and it never logs in or submits forms.
Sources: Sucuri SiteCheck, Live decoys
Want it done for you?
Every result lists the fixes with starting prices, or I can look at your site with you. Pro re-checks it every week for $12 a month, 7 days free.