Free website vulnerability scanner
Check any public website for known vulnerabilities, TLS problems, and missing security headers. No account, no payment, results in seconds.
What it checks
Known vulnerabilities (CVEs). The scanner fingerprints the software behind your site, web server, CMS, JavaScript libraries, and frameworks, then matches detected versions against published CVE data. Findings that carry a known public exploit or appear on the CISA Known Exploited Vulnerabilities list are flagged as such, because those are the ones worth fixing first.
Exposed files and paths. A set of well-known paths that should not be reachable in production, things like exposed environment files, version control directories, and debug endpoints.
Dependency vulnerabilities. Where a public manifest is reachable, packages are checked against OSV data for known advisories.
TLS and certificates. Protocol versions, cipher suites, certificate validity and chain, and HSTS.
HTTP security headers. Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options and the rest, each scored and explained.
What it does not do
This matters more than the feature list, so here it is plainly. The scanner is passive. It reads what your site already exposes: response headers, the TLS handshake, version strings, and public paths. It does not attack anything.
- It does not attempt exploitation. Nothing is injected, fuzzed, or brute forced.
- It does not do authenticated scanning or crawl behind a login.
- It does not replace a penetration test or a full DAST tool. If you need someone probing business logic and chained flaws, you need a tester, not a scanner.
- Version-based CVE matching can produce findings that a backported patch has already fixed. We show the evidence so you can judge.
The upside of staying passive is that a scan is safe to run against production and will not knock anything over.
The score
Every scan returns a single 0-100 score, weighted evenly between TLS and HTTP security headers, with a badge from Critical up to Excellent. Vulnerability findings are reported alongside the score rather than folded into it, so a CVE in a JavaScript library does not quietly distort your header grade. Every penalty value is published in how the score works.
Common questions
Is it really free? Yes. No account, no payment, no trial, no credit card. Enter a URL and you get the full report.
Can I scan a site I do not own? The scanner only reads publicly available information, the same things any visitor or search engine crawler sees, so scanning is not intrusive. Fixing what it finds is another matter, and that needs to be your site or one you are authorized to work on.
Do I need to install anything? No. It runs in the browser against any public URL.
How is this different from other free scanners? Most free tools check one layer. See how it compares to SSL Labs, securityheaders.com, and Mozilla Observatory.