We find the gaps before attackers do.
AngelForce is a cyber security company in Tallinn, Estonia. We test, monitor and defend the systems of organisations across Europe and Türkiye.
Scan your domain’s email security
Free. Checks SPF, DKIM, DMARC, DNSSEC, CAA and MTA-STS from your browser.
Certified team
- CEHCertified Ethical Hacker
- LPT MasterLicensed Penetration Tester
- CISACertified Information Systems Auditor
Organisations we have worked with
What we do
Five areas of work, all of them security. Choose one to see what it covers, how we work and what you receive.
-
Penetration testing
We attack your networks, applications and people the way a real adversary would, then show you how to close each gap.
- External and internal network tests
- Web and mobile application tests
- Social engineering
- Continuous security testing
-
Managed security
Our security operations centre watches your environment around the clock and acts on threats before they become incidents.
- SOC as a service, 24/7 monitoring
- Managed firewall
- Threat hunting
- Threat intelligence
-
Incident response
When something goes wrong, we contain it, find the root cause and help you recover.
- Emergency incident response
- Breach management
-
Consulting and training
We assess where you stand, set priorities with you and train your staff to recognise attacks.
- Security assessment
- Cyber security consulting
- Awareness training
-
Secure software
We build security into software from the first commit, and we build security tools of our own.
- Secure code review
- DevSecOps consulting
- Custom security software
- SecAudit for WordPress
-
Tell us what you need to protect
Describe your environment and what you want to achieve. We will reply by email.
Contact us
Free security tools
Eleven tools we use ourselves, free for everyone. Most run entirely in your browser, so what you enter stays with you.
-
SecAudit seal verifier
Check that a SecAudit security seal on a WordPress site is genuine, current and confirmed by its owner.
Runs in your browser, asks a public service -
Email security check
Grade a domain’s protection against spoofed email: SPF, DKIM, DMARC, DNSSEC, CAA and MTA-STS.
Runs in your browser, asks a public service -
Security headers scanner
Grade a website’s HTTP security headers, cookies and TLS certificate, with a fix for every finding.
Our server fetches the page -
Phishing link analyser
Paste a suspicious link or message and see where each link really leads, without opening it.
Runs in your browser -
Password breach check
Find out whether a password appears in known data breaches without revealing it.
Runs in your browser, asks a public service -
SPF and DMARC generator
Build correct SPF and DMARC records for your domain and check an existing SPF record.
Runs in your browser -
Email header analyser
Check SPF, DKIM and DMARC results, spoofed senders and the delivery path of an email.
Runs in your browser
What happens in a penetration test
The same five steps, whether we test one web application or an entire organisation.
Scope
We agree on targets, rules and timing in writing. Nothing is tested without your approval.
Reconnaissance
We map what an attacker can see: domains, exposed services, technologies and people.
Exploitation
We try to get in with the techniques real attackers use, and stop at the limits we agreed.
Reporting
Every finding comes with its risk, the evidence and a concrete fix, plus a summary for management.
Retest
After you have fixed the issues, we test again and confirm that they are closed.
Our products
Besides our services we build software for WordPress sites: one makes them faster, one shows whether they are secure.
All products-
Available
Velox Cache
AI PageSpeed Optimizer for WordPress
Free WordPress speed plugin: page cache, minify, JavaScript delay, WebP/AVIF and an optional AI assistant for PageSpeed findings.
Learn more -
Coming soon
SecAudit
Security audits for WordPress
Security audits for WordPress, built by AngelForce. SecAudit finds what puts a WordPress site at risk and turns it into evidence you can show to customers and auditors.
Learn more
From the blog
Practical security writing for people who run systems: what to fix, in what order, and why.
-
WordPress cache plugin benchmark: Velox, W3 Total Cache, WP Super Cache
Three WordPress cache plugins on the same server and page: time to first byte, requests per second and Google PageSpeed on mobile and desktop, with the method and the limits.
-
PHP2Shell: commands to find, patch and verify every PHP server
PHP2Shell lets attackers run code on unpatched PHP without logging in. Copy-paste commands to find every PHP runtime, update, restart and verify.
-
Test every ID in your app for IDOR and BOLA
How to find endpoints that return other users' records when an ID changes, fix them with scoped lookups, and what to check in code review.
Who does the work
Our consultants hold internationally recognised security certifications.
- CEHCertified Ethical HackerEC-Council
- LPT MasterLicensed Penetration TesterEC-Council
- CISACertified Information Systems AuditorISACA
Check our own security
A security company should be able to show that its own house is in order. This site has no database, no login and no cookies, and it sends strict security headers. Verify it with the same public tools your auditors use.
- Security headers securityheaders.com
- TLS configuration Qualys SSL Labs
- Web security Mozilla Observatory
- Web and email standards Internet.nl
Tell us what you need to protect
Describe your environment and what you want to achieve. We will reply by email.
Contact usAngelForce OÜ · Tallinn, Estonia