Phylex Scan automatically checks the security of websites and APIs you own. This guide takes you from sign-up to your first report in five steps, usually under an hour including scan time.

The console is currently in Indonesian. These guides use English names for buttons and tabs; for example Assets = Aset, Start scan = Mulai scan, Findings = Temuan, Help = Bantuan.

1. Sign up and create an organization

  1. Go to phylex.foiniks.com/daftar, sign up with Google or email + password, then click the verification link in your email.
  2. Enter your organization name (for example your company), accept the Terms of Service, and confirm that you will only scan assets you own or are authorized to test.
  3. If a colleague already invited you, the invitation appears on this screen. Accept it to join their organization instead of creating a new one. If you open the link from the invite email and have no account yet, you only set a password; no sign-up needed.
  4. If the Phylex team has set up an organization for you (for example as a client of the PDP Readiness Check service), you are invited as Owner. Tick the Terms of Service and testing-authorization boxes when you accept.

The 7-day trial requires a work email: 1 asset on your email domain (or a subdomain), 2 scans, and a watermarked PDF report. Free email such as Gmail cannot add trial assets, and each domain gets one trial.

2. Add an asset

Open the Assets tab, type the hostname you want to test (for example app.company.com) and click Add asset. Phylex only scans https:// on port 443 and rejects internal addresses such as localhost or private IPs.

Each asset shows as a card. Click the hostname to open it: inside are the IPs, detected technologies, and smaller cards for Scheduled scan, Authenticated scan, Subdomain suggestions, and Delete asset. With many assets, filter with the status chips or the search box.

3. Prove ownership

Before the first scan you must prove the asset is yours: with a DNS TXT record, a file under /.well-known/, or a signed RoE document. See verify asset ownership for the steps.

4. Run a scan

  1. On a Verified asset, click Start scan.
  2. Choose a profile: Baseline (safe, passive, about 45 minutes) for your first scan. Standard (active scan, about 1–2 hours) is available from the Pro plan and is best pointed at staging.
  3. Read the impact summary (at most 10 requests per second, User-Agent Phylex-Scanner/1.0), tick the consent box, then click Start scan.

Progress shows on Overview and the Scans tab, and you get an email when the scan finishes.

5. Read findings and download the report

Findings appear in the Findings tab from Critical to Info, each with a permanent number (F-001, F-002, …). Open a finding to see evidence, remediation, and a plain-language explanation from the Phylex Assistant. Reports are in the Scans tab under Report, as PDF, CSV, Markdown, and JSON. See scan profiles, findings, and reports.

Need help?

Click the ? icon at the top right of the console (or avatar menu → Help & guides) to create a ticket. The Phylex team replies by email and on the same page, within your plan's SLA.