signalfort · from outside
Bitrix on the internet: what the perimeter shows
Typical RU stack: Bitrix storefront, stands nearby. We look from outside — what is exposed, expired, or matched to known flaws.
- ✓Storefronts and admin areas from the internet
- ✓Versions and signatures without login
- ✓Staging on subdomains
- ✓Match to CVE and BDU
signalfort in numbers
Nothing to install. Enter a domain — and the check starts.
A typical perimeter
Production site, test copy, sometimes a panel “for a couple of days”. Different vendors — one surface.
- —Admin or test copy faces the internet
- —Version readable without login
- —HTTPS on the storefront expired
- —New landing subdomain without security review
What we look at
Only what is reachable from outside — like a visitor or attacker.
Storefronts and admin
Public areas reachable without a VPN.
Versions and signatures
Readable without login and matched to feeds.
Stands
Subdomains with copies and “temporary” environments.
Hygiene
HTTPS and root domain expiry next to vulnerabilities.
How to check
Self-service: domain → DNS → findings.
- 01
Enter the root
Shop or corporate site domain.
- 02
Verify DNS
One TXT record.
- 03
Triage the feed
Stands, SSL, stack matches — top down.
Deeper load tests only with explicit consent on higher plans
Audit vs continuous contour
A one-off Bitrix audit is stale after the next vendor release.
- Snapshot on a date
- Often needs internal access
- Misses new stands
- Report gathers dust
- 1.Outside, ongoingby plan
- 2.No admin panelno passwords
- 3.New subdomainsin alerts
- 4.Feed matchingCVE and BDU
From signal to action
A Bitrix-perimeter finding reads like any other: fact, priority, deadline.
Signature or version matched a feed
Patch / close stand / confirm
- ·host
- ·signal type
- ·why prioritized
Who it fits
Bitrix and mixed-stack companies without a dedicated SOC.
Online stores
Storefront is revenue; expired TLS and extra stands hurt immediately.
Corporate sites
Several vendors — one surface.
Integrators
Show the client perimeter without installing agents.
Plans for the job
Perimeter hygiene is in every plan; frequency and depth differ.
Radar
Free
Passive analysis and weekly hygiene. One domain.
Contour
from ₽1,490/mo
Daily checks, confirmation, fix deadlines and re-check.
Business
from ₽4,490/mo
5 domains, fix deadlines, webhooks and MCP for AI assistants, FSTEC/CRA reports, deep analysis with consent.
What usually sticks out on Bitrix
Public installs, outdated modules, open admin paths, test copies on subdomains without updates.
From outside it reads like any other web stack: versions, errors, extra services nearby.
1C and adjacent stack
Only services reachable from the internet. No agents inside the network.
PHP headlines: PHP2Shell. nginx / VMBitrix: NGINX Rift.
Matching CVE and BDU
Bitrix and PHP land in the same feed as nginx and the rest of the perimeter — with KEV and EPSS, not CVSS alone.
More: CVE and FSTEC BDU.
Several sites
Verify roots one by one. Radar — one domain free; more domains and daily monitoring on Contour and Business.
Open a free check.
FAQ
Do you need Bitrix admin access?
No. We look from outside. Deeper load tests only with explicit consent on higher plans.
Do you only look for Bitrix?
No. Bitrix and 1C are common; we also check nginx, PHP, mail, stands and HTTPS.
Is this a pentest of the shop?
No. We manage what’s exposed from outside: inventory, matching, safe confirmation. Not bug bounty or “hack for hire”.
Will you update Bitrix for us?
We show what is visible and what matched feeds. Updates and development stay with your team or vendor.
Check my site for free
Storefronts, stands and versions from the street