--- title: "Every question, on one page" description: "Every question we get about KrakenShield: SSL, privacy, code, penetration test and post-quantum audits, Kredits, NIS2, data hosting and legality." url: https://krakenshield.eu/faq/ lang: en publisher: KrakenShield (KRAKEN HOLDING SAS) overview: https://krakenshield.eu/llms.txt --- # Every question, on one page > Every question we get about KrakenShield: SSL, privacy, code, penetration test and post-quantum audits, Kredits, NIS2, data hosting and legality. Frequently asked questions What people ask about the KrakenShield platform, its five audits, Kredit pricing, the NIS2 directive and the free checks. Each answer is short and stands on its own; the linked pages go into detail. ## The platform **What is KrakenShield?** KrakenShield, also written Kraken Shield, is a European online cybersecurity platform published by the French company KRAKEN HOLDING. It offers professionals five audits (surface and SSL/TLS, privacy, code, non-destructive penetration testing, post-quantum readiness), security awareness training and certifications, at krakenshield.eu. **Is it legal to scan my system with KrakenShield?** Yes. SSL and privacy audits only observe what a website shows any visitor: they work on any public website. Penetration testing requires that you are entitled to it: you first prove that you control the domain (DNS record, file or meta tag) and accept an authorization mandate, both checked and recorded before any test. **Do I need to talk to sales or book a demo?** No. Create your account, verify your domain and run your audit: everything is self-service and takes minutes. **Where is my data hosted?** Exclusively in Europe (IONOS), in compliance with GDPR. Your data is encrypted at rest and in transit, and is never resold or transferred outside the EU. **Does code analysis send my source code?** No. The agent scans your code where it lives and only sends back the findings (vulnerabilities, dependencies, secrets). Your source code never leaves your infrastructure. **Can the penetration test break my production?** It is designed to limit impact: no denial-of-service testing, limited rates and a stop button available at any time. SQL injection detection, content discovery and brute-force simulation are off by default and require explicit opt-in in the authorization. These phases may trigger your protections, including an IP block or a test-account lockout. **What is post-quantum encryption?** Algorithms designed to resist future quantum computers. KrakenShield assesses your website’s readiness and, when it is served by Cloudflare, helps you enable a modern TLS posture through its API, with tracked and reversible changes. ## Surface and SSL/TLS audit [See the page](https://krakenshield.eu/surface-audit/) **Do I need to prove that I own the website?** No. The surface audit only uses public information and ordinary requests: you can audit any public website, for example a supplier’s. **How long does the audit take?** Usually a few minutes. The console shows progress and you can leave the page: the result waits for you in the history. **Is the grade the same as SSL Labs’?** The grade follows the method published by SSL Labs (protocols, key exchange, ciphers, caps). Both tools may differ slightly depending on the date of the analysis and the available tests. **Can the audit disrupt my website?** No. It opens a few TLS connections and HTTP requests, like a browser. No particular load, no intrusion attempt. ## Privacy audit [See the page](https://krakenshield.eu/privacy-audit/) **Does the audit make me GDPR compliant?** No, no tool can. It shows what the website really does, which lets you fix technical gaps and document your approach. **How does the tool answer the cookie banner?** It recognises the main consent management platforms and clicks “Reject”, then “Accept”, in separate visits. If the banner is not recognised, the report says so. **Can I audit a competitor’s or a supplier’s website?** Yes, the audit covers a public page, as a visitor would see it. Use the results with discernment. ## Code analysis [See the page](https://krakenshield.eu/code-analysis/) **Is my code sent to KrakenShield?** No. The agent runs on your machine and only sends results: component names and versions, triggered rules, files concerned. Flagged code excerpts stay in a local report that only you can read. **What do I need to run the agent?** A bash terminal on Linux or macOS, or PowerShell on Windows with Git for Windows. The agent checks its own integrity before starting. **How long does the analysis take?** From a few seconds to a few minutes depending on the size of the project. Progress is shown in the terminal and in the console. **Which technologies are supported?** The main ecosystems (JavaScript, PHP, Python and others) for dependencies, plus detection of libraries copied by hand into the project. ## Penetration test [See the page](https://krakenshield.eu/penetration-test/) **Is it legal?** Yes, within the frame you authorise. Testing a system without its owner’s consent is an offence in most countries: that is why domain ownership and a signed authorisation are required before any launch. **Can the test take my website down?** It is designed to avoid that: limited rates, no denial of service, intrusive phases off by default and immediate stop available. Still, let your host know, as its firewall may block the test addresses. **Which addresses do the tests come from?** From KrakenShield servers in Europe. Their IP addresses are shown in the console so you can allow them or recognise them in your logs. **How long does a test take?** From a few minutes to about an hour depending on the scope and the chosen phases. You follow progress live. ## Post-quantum audit [See the page](https://krakenshield.eu/post-quantum-audit/) **Is the scan really free, with no account?** Yes. Enter a domain on this page: no account, no e-mail, no card. The result is tied to nobody and the PDF report downloads directly. A free account adds the history of your scans and the fixes on Cloudflare. **Why act before quantum computers exist?** Because the risk starts with recording. Traffic captured today can be kept and decrypted later. Authentication can wait for computers to exist; the confidentiality of what you send today cannot. **What does the score measure exactly?** Half of the points go to the hybrid exchange being accepted, the rest to it being chosen for a browser, TLS 1.3, old versions refused, HSTS and the HTTPS redirect. Without a hybrid exchange a site stays below 50, however clean the rest is. **Do I need to prove that I own the website?** Not for the audit, which works on any public website. To change anything on Cloudflare you provide your own API token: if it does not give access to the zone, nothing is possible. **Which permissions does the Cloudflare token need?** Zone Read and Zone Settings Edit, limited to the zone concerned. We advise a token with a short lifetime. Global API keys are not accepted. **Can I really undo a change?** Yes, from the journal, which puts back the previous value and refuses if someone changed the setting since, unless you confirm. One limit is stated before you apply it: browsers that have seen HSTS remember it until its term, up to six months. **My site is not on Cloudflare. Is the audit useful?** Yes. The score and the advice apply to any server: the hybrid exchange mostly depends on a recent TLS library such as OpenSSL 3.5, and on the group order set on the server. ## Pricing [See the page](https://krakenshield.eu/pricing/) **Is there a subscription?** No. You buy a pack when you need it, with no commitment or automatic renewal. **What happens if an audit fails?** The reserved Kredits are returned. Only a successful audit is deducted. **Can I share my Kredits with my team?** Yes, Kredits belong to your organisation: all its members can use them according to their role. **Do you offer prices for resellers and agencies?** Write to us from the contact form: we consider large volumes and partnerships. ## Website security check [See the page](https://krakenshield.eu/website-security-check/) **How can I check my website’s SSL certificate for free?** Type the domain in the free test at the top of this page: in a few seconds, without an account, you get the certificate (issuer, expiry date, trusted chain, covered name), the negotiated TLS version, the HTTPS redirect and the security headers, with a verdict. For the A+ to F grade, the accepted protocols, the cipher suites and known vulnerabilities, create a free account and run the full SSL/TLS audit from the console; when its price is 0 Kredits, it is free too. **What is the difference between an SSL audit and a penetration test?** An SSL/TLS audit examines the certificate and encryption configuration exposed on the internet. A penetration test looks for weaknesses across a wider authorised scope. A good SSL grade does not guarantee that the website or its code has no vulnerabilities. **Is the SSL test free?** Sign-up is free, with no credit card. The configurable SSL price is shown on the Pricing page: at 0 Kredits, the scan is free for signed-in users. A positive price requires the displayed Kredits, with no subscription. **Can I check a website I do not own?** Yes for the SSL/TLS audit and the privacy audit: they only use public information and browser-like connections, with no ownership check. The penetration test, however, requires a verified domain and a signed mandate. **Can the audit disrupt my website?** No. The audit opens TLS connections and sends ordinary HTTP requests to observe the configuration. It attempts no intrusion and changes nothing on the server. **What does an A+ grade mean?** It is the best grade of the SSL Labs method: recent protocols only, strong encryption, a valid certificate and HSTS enabled. The grade drops with obsolete protocols (capped at B for TLS 1.0 and 1.1) and falls to F for a serious flaw. **How is it different from a regular online SSL test?** Grading follows the same method as SSL Labs. KrakenShield adds security headers, the DNS and email footprint (SPF, DMARC), visible subdomains, explained fixes and a PDF report, with the history of your audits. **My site is on shared hosting: can I fix things myself?** Partly. Security headers and HSTS can often be set in the .htaccess file. TLS protocols and the certificate usually depend on the host: the PDF report gives you the exact points to send them. **How long does the audit take?** A few minutes for the SSL/TLS audit. The report is available in your console and can be exported to PDF as soon as the analysis ends. ## NIS2 for SMEs [See the page](https://krakenshield.eu/nis2/) **How do I know if NIS2 applies to my company?** Cross-check your sector (18 sectors listed in Annexes I and II of the Directive) with your size: as a rule, at least 50 employees, or more than €10M turnover and balance sheet total. Some activities are covered regardless of size, such as DNS service providers. In France, ANSSI offers a simulator on MonEspaceNIS2. **Does NIS2 already apply in France?** Not yet. On 6 October 2026, the transposition bill, adopted by the Senate on 12 March 2025, is still waiting for its plenary debate in the National Assembly: the one planned for 7 October was postponed with no new date. The obligations will apply once the law is promulgated and its decrees published. **Does a business with fewer than 50 employees have to comply with NIS2?** In principle no, with exceptions (DNS providers, trust service providers, entities designated by the State). But if your customers are subject to NIS2, they will require security guarantees from their suppliers: in practice, many small businesses will have to apply part of the measures. **What are the NIS2 incident reporting deadlines?** For a significant incident: an early warning within 24 hours, an incident notification with an initial assessment within 72 hours, then a final report within one month of the notification. In France, the bill designates ANSSI as the national authority. **What fines does NIS2 provide for?** The Directive requires maximum fines of at least €10M or 2% of worldwide annual turnover for essential entities, and at least €7M or 1.4% for important entities, whichever is higher. Each national law sets the amounts that apply. **Are managers personally liable?** Yes, Article 20 provides that management bodies approve the cybersecurity measures, oversee their implementation and can be held liable for infringements. They must also follow cybersecurity training. **Is KrakenShield enough to comply with NIS2?** No, no tool makes you compliant on its own: NIS2 also requires governance, procedures and contracts. KrakenShield covers technical and evidence measures (SSL/TLS and privacy audits, code analysis, non-destructive penetration testing) and staff training with the Academy, with PDF reports to show your customers or the authority. ## PHP2Shell check [See the page](https://krakenshield.eu/php2shell-check/) **Is the check really free?** Yes, no account and no limit other than a reasonable number of checks per quarter of an hour. **Can the check break my website?** No. We make a single visit of the home page and read the headers, like a browser. Nothing is sent to exploit the flaw. **My site hides its PHP version, am I safe?** No, hiding the version fixes nothing: attackers try the flaw blindly. Check the version in your hosting panel or with php -v on the web server. **Does my hosting provider take care of it?** Shared hosts usually update PHP, but you often have to select the new version yourself. On a dedicated server or a VPS, it is up to you. ## eMudhra check [See the page](https://krakenshield.eu/emudhra-check/) **Is the check really free?** Yes, no account and no limit other than a reasonable number of checks per quarter of an hour. **How do you recognise a compromised intermediate?** By the key identifier and name of the six TLS intermediates published with the disclosure (EM DV, OV and EV TLS CA - G3B and G3C), including their Sectigo cross-signed versions. **My eMudhra certificate is not compromised, should I still replace it?** Yes, soon. eMudhra is leaving the global TLS certificate market and Chrome is removing its ECC root: a certificate that depends on it will soon stop being recognised. **Does the check read my data?** No. It opens a TLS connection, reads the public certificate your server shows every visitor, then closes it. ## HTTP2Shell check [See the page](https://krakenshield.eu/http2shell-check/) **Is the check really free?** Yes, no account and no limit other than a reasonable number of checks per quarter of an hour. **Can the check break my website?** No. We make a single visit of the home page and read the headers, like a browser. No crafted compressed data is sent. **Why can the check not be certain?** The only direct proof would be to send a crafted Brotli stream, which may crash the server. We stick to what the site discloses: the technology, and its version when visible. **My site runs PHP or WordPress, am I affected?** The site itself rarely, but the tools running next to it may be: Node.js scripts, Python bots, an Envoy proxy or libraries reading fonts or images. List the versions on the server. Go further ## The other audits of the platform [PricingKredit packs and the cost of each audit.Read](https://krakenshield.eu/pricing/) [Demo videoThe platform on video, in 40 seconds.Read](https://krakenshield.eu/demo/) [Cyber AcademyAwareness training and KrakenShield certifications.Read](https://krakenshield.eu/academy/) Take action ## Run your first audit today Free sign-up, no credit card. Buy Kredits when you need them to run your first audits. Your console is ready: start an audit or follow your running analyses. Free sign-up, no credit card. Hosted in Europe.