ECZ-ID Website Security — Live Website Check

Know what is publicly true about a deployed website now — and know what remains unknown.

Run a free, non-intrusive current-state check from VS Code. No ECZ-ID account, card, API key or repository upload is required.

Useful for

• website owners and developers
• agencies and MSPs reviewing customer websites
• security and platform teams checking public deployment state
• organisations that need a shareable current-state reference before remediation or continuity monitoring

What you get

• public HTTPS and certificate evidence;
• public DNS evidence;
• selected response-header / security-control observations;
• self-reported runtime evidence when the site discloses it — clearly marked unverified;
• edge/CDN markers when supportable — never treated as proof of WAF protection;
• known-version comparison only when the production engine has enough evidence;
• explicit UNKNOWN where public evidence cannot establish the answer;
• observation time, re-check due time and check reference when supplied by the production contract;
• one evidence-derived next action.

What you can do in under a minute

1. Open the Command Palette.
2. Run ECZ-ID Website Security: Check Website Current State.
3. Enter a public hostname such as yourbusiness.com.
4. Review OBSERVED evidence, UNKNOWNs, currentness and the recommended next action.

The extension uses the same eczid.website-public-check.v1 production observation contract as the ECZ-ID Website Security experience. It does not perform exploit testing, brute force, authenticated scanning or penetration testing.

Example use cases

• Check a website after a security patch or hosting change.
• Establish a current public-state reference before a customer security conversation.
• Re-check a site affected by a fast-moving vulnerability campaign without claiming that an unknown runtime is patched or vulnerable.
• Move from a point-in-time check to Website Trust Continuity when ongoing currentness is required.

What leaves your machine

Only the public hostname you explicitly choose to check is sent to the ECZ-ID Website Public Check service.

The extension does not send repository contents, source code, .env contents, credentials, secret values, prompts or arbitrary workspace files. There is no hidden extension telemetry.

Evidence semantics

ECZ-ID deliberately distinguishes:

• OBSERVED — supported by the public observation;
• UNKNOWN — not established by the available evidence;
• CURRENT / RE-CHECK DUE / STALE — time currentness of the observation;
• ACTION REQUIRED / ACTION RECOMMENDED — only where the authoritative result supports it.

Unknown evidence is not counted as a problem. A public check is not a penetration test, certification or security guarantee.

Point-in-time vs Continuity

The free extension performs an on-demand point-in-time check. VS Code may be closed, so the extension does not claim continuous monitoring.

If you need ECZ-ID to keep website evidence current outside the editor, Website Trust Continuity is an optional separate operating service. The core website identity/current-state reference and paid continuity operations remain distinct.

Critical Watch campaigns

Fast-moving campaigns such as major PHP/runtime incidents are use cases, not the identity of this extension. Runtime state remains UNKNOWN where the serving build cannot be established publicly, and vendor backports must not be misclassified from an older-looking version string alone.

Privacy & permissions

Machine-readable facts

First use

Install ECZ-ID Website Security — Live Website Check, run ECZ-ID Website Security: Check Website Current State, and enter the public hostname you want to observe.

ECZ-ID is independent trust infrastructure. Third-party names describe external ecosystems only and do not imply endorsement.