Scan any public domain for website controls mapped to SOC 2 Trust Services Criteria. Sitewrap emails the report. Wrap the site at the edge when you want those gaps closed.
Not a certification. A production snapshot of what the internet can already see — plus a path to close the gaps.
B2B SaaS and other companies that sell to enterprises. Buyers ask for SOC 2 before they sign, and they look at the public domain first.
Security reviews arrive before legal. “Are you SOC 2?” is a gate, not a brand question. Teams lose weeks assembling screenshots of headers, cookies, admin URLs, and vendors while the buyer’s InfoSec queue moves on.
Buyers and scanners hit the public hostname, not your VPC. Missing HSTS, open wp-login, XML-RPC, mixed content, and a homepage with no privacy link show up in vendor reviews long before anyone reads an internal policy wiki.
App teams have IAM, SSO, and tickets. The WordPress, Webflow, or marketing origin still serves /xmlrpc.php, versioned Server headers, and unguarded forms. The domain on the contract is in scope even when the product lives elsewhere.
A WAF from last quarter does not count without artifacts. Auditors ask who changed headers, whether cookies are consent-gated, and if recordings mask input. The Type II clock starts whether that folder is ready or not.
If a buyer, marketplace, or InfoSec questionnaire can block revenue, you need a website control story — not a brochure site with open wp-login.
You just got the first security questionnaire from a bank, health system, or Fortune 500. You need a website control story this week — not a 12-month audit fairy tale.
The observation window is opening. You still need CC6/CC7 evidence on the property customers actually visit: TLS, headers, access to admin, logging, and change history.
The product is in a reviewed cloud account. The careers and marketing domain is not. That gap is exactly what a picky reviewer will screenshot.
You operate many sites. Clients need a consistent edge: firewall, headers, consent, leads, and an audit trail — without rebuilding every CMS.
HTTPS, HSTS, security headers, cookie flags, mixed content, consent signals, and probe paths such as .env, .git, xmlrpc.php, and wp-login.php.
TLS on the public host, HTTP→HTTPS, nosniff, clickjacking, Referrer-Policy, Permissions-Policy, CSP.
Secure and SameSite on Set-Cookie. HttpOnly on session-like cookies.
.env, .git/HEAD, xmlrpc.php, wp-login.php, phpinfo — blocked or gone, not 200 OK.
Privacy policy link, cookie notice or CMP signatures on the homepage HTML.
Homepage status and timing. Edge/CDN hints when present.
robots.txt and security.txt so researchers and crawlers have a sane path.
Wrap the existing CMS with an edge control plane — firewall, headers, consent, admin gating, and an audit trail — without rebuilding the site.
Keep your auditor. Use Sitewrap for the public website: evidence, not a substitute for HR, risk, or production-app SOC 2.
Short answers on certification, Type II, scanning, email, and what wrapping actually covers.
No. The snapshot maps publicly observable website controls to SOC 2 Trust Services Criteria (security, availability, confidentiality, privacy). It is not an AICPA SOC 2 Type I or Type II report and does not certify your company. Your auditor still needs policies, access reviews, vendor management, and an observation period.
B2B SaaS and other companies that store or process customer data and sell to enterprises — especially those filling CAIQ/SIG questionnaires, joining marketplaces, or closing security reviews with banks, health, and large tech. The website on the contract is almost always in scope even when the “product” lives elsewhere.
The scan only requests publicly reachable URLs (homepage, robots, a short list of well-known paths). It does not authenticate, fuzz, or exploit. Use it on properties you operate or are authorized to assess. We rate-limit abuse.
We send the report to the address you provide and store it as a Sitewrap lead so our team can follow up if you want the gaps closed at the edge. See the Privacy Policy. You can ask us to delete the lead at any time.
Sitewrap becomes the control plane in front of the existing CMS: firewall, headers, consent, form protection, operator MFA, audit log, backups, and a Compliance tab with TSC-mapped evidence. That is the website slice of CC6/CC7/P2/A1 — not a substitute for HR, risk, or production-app SOC 2.
Sitewrap operates a SOC 2-aligned control program (security, availability, confidentiality). Contact us for current program status, questionnaire support, the DPA, and the Privacy Policy. We do not claim certification on this page.
Enter a domain, get the emailed report, then wrap the site if you want the gaps closed at the edge.