Website security checks
Forgotten test pages, no protection against fake emails, expired domains. We look for the gaps visible from outside every day, and stay with you until they're fixed.
From ¥1,000 a month. Cancel anytime.
Check results for example.co.jp
Safety seen from outside
C
Needs attention
3 DOORS
Big companies make the news, but about two-thirds of ransomware victims in Japan are small and medium-sized businesses. Check whether any of these apply to you.
34%
Share of password-theft break-ins that exploited weak password management. The most common method
National Police Agency of Japan, 2024 arrests: 174 of 511
What MAMORRZ does From Light
We find leaked passwords and check whether two-step verification is on
What you do
Change the passwords we find and turn on two-step verification (we give you the steps)
≈1.2M
Phishing reports (fake emails and sites) in just six months
National Police Agency of Japan, first half of 2025: 1,196,314
What MAMORRZ does From Light
We judge whether an email you paste is dangerous (from Standard), and check your anti-spoofing settings daily
What you do
When unsure, paste it before opening (we don't see emails you don't paste)
80%+
Share of ransomware intrusions through VPN or remote desktop devices, caused by easy passwords or forgotten accounts
National Police Agency of Japan, first half of 2025, survey of victims
What MAMORRZ does From Light
We watch daily from outside for exposed devices, outdated versions, forgotten files and expiry dates
What you do
Use strong passwords on devices and delete unused accounts (we don't look inside devices)
MAMORRZ finds the problems and gives you the fix. You fix them. MAMORRZ keeps watching.
59% of organizations hit by ransomware spent ¥10 million or more on recovery (National Police Agency of Japan, first half of 2025).
Sources: National Police Agency of Japan, "Unauthorized access in 2024" and "Cyberspace threats in the first half of 2025"
3 WAYS
You can start with the outside check alone. You can also check in-house safeguards, and to look inside your code, upload a zip.
We check your registered domains automatically every day, the same way an ordinary visitor sees them. Nothing to install. All plans.
Check whether your passwords have leaked in the past, and check the in-house safeguards a machine cannot see with a ten-question self-check (all plans). You can also check suspicious emails you receive (from Standard).
Zip your program and upload it to check for gaps inside. Keys and database copies are removed on your own computer before sending. In-house systems without a domain can be registered too (from Standard). Companies that keep their code on GitHub can connect it on Pro (for specialists) for a daily watch of weak parts, weekly automatic checks and "Have MAMORRZ fix it" (sites published on Vercel, Netlify or Cloudflare Pages only).
WHO IT'S FOR
We explain what could happen and how to fix it, in plain language.
A ready-to-send request letter lets you ask your usual web company right away.
We also check every day for databases readable without login and embedded keys.
We tell you exactly what to press, in the words of your own hosting company's screens (from Standard).
From the check results we draft answers for their checklists and make a monthly report (Pro).
RISKS
Attackers aim at places even the people who built them have forgotten. If someone looks from outside every day, you notice a gap the day it opens.
A separate address made for some work is still up and anyone can open it. It may still hold old systems or customer data.
Someone sends fake emails to your clients using your company's address. Often a few lines of settings would have prevented it.
One morning, the website and email both stop. A common cause: the person in charge of renewals had left the company.
A settings file containing passwords or keys sits where anyone can read it — sometimes for years without anyone noticing.
WHAT WE CHECK
ALWAYS UP TO DATE
Attack methods change every day. So we don't just keep checking: we keep improving the checks themselves, at no extra charge.
1
All your registered domains are checked automatically every day. You only get an email when a new problem appears.
2
We update our checks to follow new attack methods and weaknesses being exploited in real attacks. There is nothing for you to do.
3
So the watcher doesn't become a target, MAMORRZ itself is regularly checked and updated.
REPORT
A score and colors show where you stand, and each finding explains what could happen and how to fix it, in plain words.
Safety seen from outside
C
Needs attention
If left alone: Someone could exploit weaknesses in old systems or read customer data that was added for testing.
If it's not in use, remove the address entirely. If it is, put a password on it or make it open only from inside the company.
HOW WE FIX
With "Have MAMORRZ fix it" (Pro, for specialists), we build a fixed version without touching your live site. Only what you check on a test site and approve goes live. If it isn't right, you can stop it before it goes live as many times as needed.
Build a fixed version
Check on a test site
Approve
Put it live
Re-check to confirm
WHAT WE LOOK AT
MAMORRZ only looks at what anyone in the world can already see right now. We never get inside or force anything open. Attackers look at the same places every day with automated tools.
Only domains confirmed with the owner can be checked, and only your staff can see the results. Remove a domain on screen and checks stop that day; its results are deleted right away.
TRUST
We read public records and open your site the same way an ordinary visitor does. No extra load on your site.
We only check domains whose ownership has been confirmed, which makes it hard to misuse for scouting other companies.
We only read them during a check or fix, and don't store them on our side. Fixed versions are created in your own code storage. You can disconnect GitHub at any time. Code uploaded as a zip is also deleted after reading.
Only changes you check on a test site and approve go live — and you press the button yourself. We never change your live site on our own.
PRICE
All prices include tax. Choose monthly, or yearly to get two months free. Cancel anytime.
We find issues and give you the fix and request text
¥1,000 / month
Yearly ¥10,000 · 2 domains
Steps for your own server, and a zip check inside your code
¥2,000 / month
Yearly ¥20,000 · 1,200 pt each month · 6 domains
GitHub connection for specialists, and reports to show partners
¥3,000 / month
Yearly ¥30,000 · 2,800 pt each month · 10 domains
Swipe the table sideways to see the other plans →
| Light | Standard | Pro | |
|---|---|---|---|
| In a word | We find issues and give you the fix and request text | Steps for your own server, and a zip check inside your code | GitHub connection for specialists, and reports to show partners |
| Monthly price (tax incl.) | ¥1,000 | ¥2,000 | ¥3,000 |
| Domains | 2 | 6 | 10 |
| Monthly points | - | 1,200 pt | 2,800 pt |
| Daily watch of all domains (from outside) | ✓ | ✓ | ✓ |
| New-problem emails and monthly summary | ✓ | ✓ | ✓ |
| Password leak check and ten-question self-check | ✓ | ✓ | ✓ |
| Fix steps and request letters for your web company | ✓ | ✓ | ✓ |
| Fix steps matched to your hosting company's screens (Xserver, XServer Business, Sakura, Lolipop, Mirai Net; DNS: Onamae.com, Cloudflare) | - | ✓ | ✓ |
| Suspicious email check | - | ✓ (about 30 pt each) | ✓ (about 30 pt each) |
| Upload a zip for a check inside your code (no GitHub) (WordPress themes and plugins too) | - | ✓ (about 400 pt each) | ✓ (about 400 pt each) |
| Register and check in-house systems without a domain | - | ✓ | ✓ |
| For specialists: daily watch of weak parts in useGitHub required | - | - | ✓ |
| For specialists: automatic weekly code checkGitHub required | - | - | ✓ (weekly fits your points) |
| Help putting your code on GitHub (guide) | - | - | ✓ |
| For specialists: we fix gaps visible from outside (for people who can check the fixed version on a test site themselves)GitHub requiredVercel, Netlify or Cloudflare Pages sites only | - | - | ✓ (about 23 a month with monthly points only) |
| For specialists: we apply small weak-part updates (taking in GitHub's automatic update proposals)GitHub requiredVercel, Netlify or Cloudflare Pages sites only | - | - | ✓ |
| For specialists: fixes inside your codeGitHub requiredVercel, Netlify or Cloudflare Pages sites only | - | - | ✓ |
| Monthly report for management and partners (save as PDF) | - | - | ✓ |
| Draft answers for partners' security checklists | - | - | ✓ (about 200 pt each) |
| Buy more points | - | ✓ | ✓ |
If your site doesn't use GitHub
Features marked "GitHub required" (for specialists) aren't available. The daily outside watch, in-house checks, fix steps and request letters still work. To check inside your code, Standard and above let you upload it as a zip (keys and database copies are removed on your own computer before sending). Pro also includes a guide for putting your code on GitHub. For fixes, ask your usual web company or contact us.
On Standard and Pro, you can buy more points when you run low
¥1,000 for 1,200 pt · ¥3,000 for 3,600 pt · ¥5,000 for 6,000 pt · ¥10,000 for 12,000 pt (valid 180 days from purchase). As a guide, one suspicious email check uses about 30 pt, one code check about 400 pt, and one fix (Pro) about 120 pt.
When a major fix is needed, you have two options
1. Ask your usual web company or contractor
You can hand over the request letter, which sets out the issue and how to fix it. The letter is included in the price.
2. If you have no one to ask, talk to us
We will look at what is needed and send a separate quote. This also covers sites that don't use GitHub.
Contact us: contact@hrs-grp.co.jpFAQ
Yes. We update our checks to follow new methods and weaknesses being exploited in real attacks, with no extra charge or action on your part.
A specialist's penetration test is a one-off, in-depth test close to a real attack. MAMORRZ is a daily watch that sends no attack-like traffic. It doesn't replace a specialist test, but helps you catch everyday oversights.
From ¥1,000 a month for Light, ¥2,000 for Standard and ¥3,000 for Pro (tax included). Cancel anytime.
Yes. Every result explains what could happen and how to fix it in plain words. We also give you a request letter you can send straight to your web company.
No. We only look a little at a time, the same way an ordinary visitor opens your site.
If you log in with your company address, just press a button. If you log in with Gmail or similar, press the button in an email sent to your company address. We also prepare a message you can send to your web company.
We mainly check what can be seen from outside (on Standard and above, we also read code you upload as a zip), so we can't promise to find everything. But because we check every day, you'll notice new gaps quickly.
Under "In-house checks", you can paste a suspicious email to see if it is dangerous (Standard and up), check whether a password has leaked, and answer a 10-question self-check on in-house safeguards (all plans). We watch the entry points of VPN devices that can be seen from outside, but not the settings inside those devices or office computers.
Before sending a zip, your own computer removes files likely to hold keys and database copies, and hides key-like values. Uploaded code is deleted right after reading and not stored. We never receive database contents.
Each finding shows "We can fix this", "Large: separate quote" or "Your setting or decision" with a reason. We fix simple ones (Pro, for specialists); for large ones we give a request letter or a separate quote. For large core systems, we recommend a specialist assessment company from the start.
You can hand the request letter to your usual web company. If you have no one to ask, we can send a separate quote.
Yes. You can cancel anytime from the "Plan" screen.
From ¥1,000 a month. Just enter your domain and confirm you own it.
Sign up