Free website vulnerability scanner
Check any public website for known vulnerabilities, TLS problems, and missing security headers. No account, no payment, results in seconds.
What it checks
Known vulnerabilities (CVEs). The scanner fingerprints the software behind your site, web server, CMS, JavaScript libraries, and frameworks, then matches detected versions against published CVE data. Findings that carry a known public exploit or appear on the CISA Known Exploited Vulnerabilities list are flagged as such, because those are the ones worth fixing first.
Exposed files and paths. A set of well-known paths that should not be reachable in production, things like exposed environment files, version control directories, and debug endpoints.
Dependency vulnerabilities. Where a public manifest is reachable, packages are checked against OSV data for known advisories.
TLS and certificates. Protocol versions, cipher suites, certificate validity and chain, and HSTS.
HTTP security headers. Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options and the rest, each scored and explained.
What it does not do
This matters more than the feature list, so here it is plainly.
A default scan asks for the home page of the site you named (the root of that address: any path you typed is not requested), following its redirects (once more if the first attempt fails to connect), the way a browser does. To check the site's TLS setup it also opens a series of TLS connections, trying in turn the protocol versions and ciphers we test, and in one of them sends a single deliberately malformed heartbeat message: the standard test for the Heartbleed bug (CVE-2014-0160). A server that is not vulnerable ignores or rejects it. A vulnerable one answers with a block of its memory; the scanner reads that one reply only to see that it arrived, then discards it without logging or storing any of it. With DNS and email checks turned on, the scan also looks up public DNS records through public resolvers; those queries never reach the site.
The vulnerability scan is the active part, and it is off by default. When you turn it on, it also fetches one of the page's JavaScript files and that file's source map, and requests about 35 well-known paths on the site, such as /.env, /.git/config, admin pages and dependency manifests, to find files that should not be public. These are ordinary GET requests, and they go only to the site you named or its www. address, never to a different site it redirects to. It does not exploit anything, log in, guess passwords, submit forms or send attack payloads.
Run the vulnerability scan only against a site you own or are authorized to test; the scanner asks you to confirm that before it runs. Each site gets a limited number of vulnerability scans per day, counted across everyone, and a site's owner can ask us to stop running them against their domain.
- It does not inject, fuzz or brute force anything, and it does not try to break in. The one deliberately malformed message it sends is the Heartbleed test described above.
- It does not do authenticated scanning or crawl behind a login.
- It does not replace a penetration test or a full DAST tool. If you need someone probing business logic and chained flaws, you need a tester, not a scanner.
- Version-based CVE matching can produce findings that a backported patch has already fixed. We show the evidence so you can judge.
It does not log in or change anything on the site. What each request is, and how a site owner opts out, is on About the scanner.
The score
Every scan returns a single 0-100 score, weighted evenly between TLS and HTTP security headers, with a badge from Critical up to Excellent. Vulnerability findings are reported alongside the score rather than folded into it, so a CVE in a JavaScript library does not quietly distort your header grade. Every penalty value is published in how the score works.
Common questions
Is it really free? Yes. No account, no payment, no trial, no credit card. Enter a URL and you get the full report.
Can I scan a site I do not own? The scanner only reads publicly available information, the same things any visitor or search engine crawler sees, so scanning is not intrusive. Fixing what it finds is another matter, and that needs to be your site or one you are authorized to work on.
Do I need to install anything? No. It runs in the browser against any public URL.
How is this different from other free scanners? Most free tools check one layer. See how it compares to SSL Labs, securityheaders.com, and Mozilla Observatory.