Test your web apps for security flaws. Prove it.
Automated, scheduled scanning for the websites and APIs you own, clear explanations of every finding, and reports you can hand straight to an auditor. Nothing to install.
Sign up with your work email · no credit card · Ringkasan Bahasa Indonesia (PDF)
- Findings mapped to CWE, the OWASP Top 10 & ISO/IEC 27001 controls
- Data stored in Google Cloud's Jakarta region
- Ownership checked before every scan
How it works
Verify your asset
Prove you own the domain with a DNS TXT record or a file. Only assets you own can be tested, and the proof is re-checked before every scan.
Scan
Run scans on demand or on a schedule. The scanners run in Phylex's cloud in Jakarta, so there is nothing to install.
Report & fix
Findings grouped by severity, with remediation steps, triage, and automatic retests.
What we check
Web vulnerabilities
The OWASP Top 10 with OWASP ZAP & Nuclei: security headers, injection, misconfiguration.
TLS & certificates
Protocols, ciphers, and certificate expiry with testssl.sh.
Email domain security
SPF, DKIM, DMARC, and CAA, so nobody can send mail pretending to be you.
Open ports & services
Services accidentally exposed to the internet (only with your consent, per scan).
Subdomain discovery
Subdomains from passive sources that may have been forgotten.
Active CVE intel
Actively exploited vulnerabilities (CISA KEV) that match the technology on your assets.
Plans
Start with a free trial and upgrade any time from inside the app.
| Feature | Trial | Starter | Pro | Business |
|---|---|---|---|---|
| Price | Free | IDR 490,000 / mo | IDR 1,490,000 / mo | IDR 3,900,000 / mo |
| Term / billing | 7 days | Monthly | Monthly | Monthly |
| Assets (web/API) | 1* | 4 | 10 | 30 |
| Manual scans | 2 in total | 4 / mo | 20 / mo | 100 / mo |
| Scheduled scans | No | Weekly | Weekly | Daily |
| TLS & email security | Yes | Yes | Yes | Yes |
| Subdomain discovery | No | Yes | Yes | Yes |
| Active scanning & ports | No | No | Yes | Yes |
| CVE intel & threat scans | No | No | Yes | Automatic |
| Authenticated scans (token, cookie) | No | No | Yes | Yes |
| Reports | Watermarked PDF | PDF·CSV·MD·JSON | PDF·CSV·MD·JSON | PDF·CSV·MD·JSON |
| Ticket response | 72 hours | 48 hours | 24 hours | 8 hours |
*Trial: 1 asset on your work email domain; full detail for Critical & High findings. Prices exclude 11% VAT. Details, payment methods, and the refund policy are on the Pricing page, or you can .
More from Phylex
Phylex Scan is part of the Phylex family, and every product is managed from one Phylex Console. Pick what fits your need, or talk to our team.
Continuous monitoring
Know first when something changes on your attack surface.
Phylex Watch
External attack surface monitoring (EASM) per domain: new subdomains and takeover risk, injected online-gambling spam and defacement, risky open ports, expiring certificates and domains, lookalike domains, and accounts stolen by infostealers. Runs automatically every day, with email alerts.
- EASM
- Gambling spam & defacement
- Ports & services
- Critical threats
Regulatory compliance
Get ready for Indonesia's PDP Law before 16 January 2027.
Phylex Comply
Readiness for the PDP Law and GR 33/2026. The guided PDP Readiness Check service is available now; the compliance workspace (processing register, DPIA, incident plan) is on the way.
- PDP Readiness Check
- Workspace (soon)
Tested by experts
The Phylex testing team finds what automated scanners miss.
Phylex Pentest
Manual penetration testing for web, API, mobile, and cloud, with findings mapped to ISO/IEC 27001 controls.
- One-off
- Retest
- Annual
- VIP (Mobile Pentest)
Phylex IoT Lab
Testing for connected devices (firmware, debug ports, OTA updates, and radio) with an ETSI EN 303 645 readiness report.
Internal networks & branches
Test systems that cannot be reached from the internet.
Phylex Probe
Test internal networks and offline systems from the inside. Run it as an agent on your server, or as a plug-in device for branches.
- Virtual
- Box
Full product details: foiniks.com/#phylex ↗
Frequently asked questions
What is Phylex Scan?
Phylex Scan is an automated security scanning service for the websites and APIs you own. It checks for web vulnerabilities (the OWASP Top 10), TLS configuration, email domain security (SPF, DKIM, DMARC), and more, then writes a report with remediation steps.
Can a scan disrupt my website?
The Baseline profile is passive, uses safe templates, and is rate-limited to about 10 requests per second. Destructive tests, denial of service, and brute force are never run. The Standard profile performs limited active scanning and may submit forms with test data, so we recommend running it against a staging environment.
Which websites am I allowed to scan?
Only assets you own or have written permission to test. Ownership is proven with a DNS TXT record or a verification file, and it is re-checked before every scan.
How much does it cost?
The trial is free for 7 days, covers 1 asset on your work email domain, and needs no credit card. The Starter plan is IDR 490,000 per month (excluding tax) for 4 assets with weekly scheduled scans. Pro and Business plans are available for larger needs.
How long does a scan take?
A Baseline scan usually finishes in 35 to 70 minutes, depending on the size of the application. The Standard profile can take around two hours.
Where is my data stored?
In Google Cloud's Jakarta region (asia-southeast2). Raw scan output is deleted automatically after 90 days, and notification emails contain only a summary, never vulnerability details.
How is Phylex Watch different from Phylex Scan?
Phylex Scan tests the applications you have added as assets for vulnerabilities. Phylex Watch monitors your whole domain every day to find forgotten subdomains, injected online-gambling spam or defacement, risky open ports, expiring certificates, and lookalike domains. Subdomains Watch finds can be added to Scan as assets in one click. Watch is currently open as a limited trial; contact us to join.
Does Phylex Scan replace a manual penetration test?
No. Automated scanning cannot find every weakness, especially business-logic flaws. For in-depth testing, use the Phylex Pentest service.
Ready to see where your application stands?
Verify one domain and get your first Baseline scan results, usually within 35 to 70 minutes.