Scan your website, browser or file before someone else does.
Scan.now runs passive checks and bounded owner-authorised active tests, then explains every result: What was tested, why it matters, and exactly how to fix it. Nothing you upload is stored.
Headers, TLS, cookies, exposed files, outdated JavaScript and email spoofing protection. More about the Website Scanner
Checks public HTML, same-origin JavaScript and linked source maps. Any match is redacted and never validated. More about the LLM API Key Scanner
Crawls up to 30 pages: Indexability, titles, headings, duplicate and thin content, broken links, speed and structured data. More about the SEO Audit
Fingerprints plugins, themes and core, then matches every version against 43,000+ known CVEs. More about the WordPress Scanner
Certificate chain and hostname, expiry, key size, protocol versions and cipher families. More about the SSL / TLS Checker
SPF, DKIM, DMARC, MX, DNSSEC and CAA: Everything that decides who can spoof your domain. More about the Email (SPF, DKIM, DMARC)
Lookalike and punycode domains, shorteners, redirect chains and brand impersonation. We never submit the form on the page. More about the Phishing URL Checker
Runs in your own browser: Fingerprint uniqueness, IP and WebRTC leaks, version currency and which policies it enforces. More about the Browser Check
Documents, archives, installers, scripts and images are analysed in memory and never stored. More about the File Scanner
Focused scanners, one honest report style.
Pick the thing you are worried about. Each scanner links every finding to a plain-language explanation and a fix.
A passive, non-intrusive scan of any public website: Security headers, TLS configuration, cookie flags, exposed files, mixed content, outdated JavaScript libraries and email-spoofing protection. Graded A to F with a fix for every finding.
Runs entirely in your browser: Measures how unique your fingerprint is, tests WebRTC and IP leaks, checks whether your browser version is current, and probes which security policies it actually enforces.
Upload a file up to 64 MB and get a verdict from signature matching, structural analysis and behavioural heuristics: Hidden executables, Office macros, PDF JavaScript, double extensions, archive bombs and more. Files are analysed in memory and never stored.
Identifies a website's technology stack, redirects and infrastructure from representative pages, assets, headers, cookie names and DNS records. Every detection includes a plain-language explanation and optional technical evidence.
Looks up a domain in a published Common Crawl domain web graph and reports its Harmonic Centrality rank, value and percentile alongside PageRank. The result names the exact graph release and lookup coverage.
Owner-authorised application security tests
Choose one focused check for a site you own or have explicit permission to assess. A registered account is required and results are Premium-only.
Live scan activity
Every scan Scan.now runs, as it happens. Targets and addresses stay censored until Scan.now reaches 2,000 unique visitors in one day.
Four fifths of every target and three quarters of every address are replaced with dots before the row is stored. Uncensored website addresses unlock permanently at 2,000 unique visitors in one day. Rows are deleted after seven days.
How to check if a website is safe
The short answer: Look at what the site sends your browser before you trust what it shows you. Four things decide it, and all four are visible from outside without asking the owner’s permission.
- Is the connection actually private? A padlock proves encryption, not honesty. What matters is whether the certificate is valid for that exact hostname, issued by a trusted authority and current — and whether the server still accepts protocol versions deprecated years ago. The SSL/TLS checker answers all four in one handshake.
- Does it defend your browser? Security headers tell the browser to block whole classes of attack. Their absence is the most common finding we see. The headers checker lists what is missing and gives you the configuration line for each.
- Is it running something with a known hole? Outdated JavaScript libraries and unpatched WordPress plugins are how most sites are actually compromised, not anything clever. The JavaScript scanner and the WordPress scanner match what a site ships against published vulnerability data.
- Can someone send email pretending to be it? A domain without enforced SPF, DKIM and DMARC can be impersonated by anyone. The email security checker shows whether a forged message would be delivered or rejected.
If you were sent the link rather than typing it, that is a different question: The phishing URL checker follows it from our server and tells you where it actually ends up, without it ever touching your browser. If the whole message looks suspicious, paste its original source into the email header analyzer to see the sender, sending IP, route and SPF, DKIM and DMARC evidence.
Who Scan.now is for
You run a website
You want to know what a stranger can see, and you want the fix rather than a score. Start with the website scanner, then the SEO and site health audit for whether anyone can find it. Every finding links to the configuration you need.
You audit sites for other people
You need the whole site, not the first page, and a report you can hand over. A paid plan crawls to 5,000 pages, runs every scanner in one job and produces a downloadable report. Nothing is exaggerated, which matters when your name is on it.
Something arrived and you do not trust it
An attachment, a link, or a password you have used somewhere you should not have. The file scanner, the link checker and the breach check answer in seconds, and none of them keep what you give them.
You want to understand, not just be told
Every result links to one of 194 check pages explaining the test, the attack behind it and the fix, backed by 61 guides. That reference is the point of the site; the scanners tell you which parts apply to you.
How a scan works
Passive means we look; we never push. Here is what happens in the fifteen seconds after you press Scan.
We request the page once, follow redirects, and record every header, cookie and script the way Chrome or Firefox would see them.
TLS handshakes per protocol version, DNS lookups for SPF, DMARC, DKIM, CAA and DNSSEC, and requests to a fixed list of paths that should never be public.
Findings are weighted by severity into a score and a letter grade. Every line links to a page describing the test, the risk and the fix.
Learn the why behind every check
Four hub guides, each with a cluster of practical spokes, written to go with the scanners rather than to fill a blog.
Browser SecurityHow your browser gets tracked and exploited, and how to harden it.
Website SecurityWhat a vulnerability scan looks for on a website and how to fix what it finds.
Malware & File SafetyHow malware hides in ordinary files and how scanners catch it.
Privacy & SecurityTracking, leaks, passwords and phishing: Protecting yourself online.
Recently updated guides
8 min read · Updated Sep 20, 2026
SQL Injection Explained: How It Works, Real Consequences and How to Prevent It
SQL injection turns user input into database commands. The mechanism with examples, why it is still common, why external scanners rarely...
Read the guide
8 min read · Updated Sep 20, 2026
Outdated JavaScript Libraries: Why Old jQuery and Angular Are a Real Risk and How to Find Them
A page that ships an old library ships its known vulnerabilities. How Retire.js-style detection works, the most common vulnerable...
Read the guide
9 min read · Updated Sep 20, 2026
Exposed LLM API Keys: How They Leak, How to Find Them and What to Do Next
An LLM API key in browser JavaScript is a public bearer credential. Learn how OpenAI, Anthropic, Gemini and other keys reach frontend...
Read the guide
9 min read · Updated Sep 19, 2026
The OWASP Top 10 Explained in Plain Language
The OWASP Top 10 is the most cited list of web application risks. Each category with a concrete example, which ones a scanner can detect...
Read the guide
8 min read · Updated Sep 19, 2026
Cross-Site Scripting (XSS) Explained: Reflected, Stored, DOM-Based and How to Prevent It
XSS lets an attacker run their own script in your users' browsers. The three types, what an attacker does with it and the layered...
Read the guide
9 min read · Updated Sep 18, 2026
SSL and TLS Explained: Certificates, Handshakes, Protocol Versions and Cipher Suites
TLS is the protocol behind the padlock. What a certificate proves, how the handshake works, why TLS 1.0 and 1.1 are retired, what a...
Read the guideWhat makes Scan.now different
No payloads, no brute force, no form submissions. You can point it at your own site during business hours without a maintenance window.
The checks reference has a page for each of the 194 tests: What we look for, the attack it relates to, and configuration you can paste.
Uploaded files live in memory for the length of the scan. Website reports are kept 30 days at an unguessable link and are excluded from search engines. We retain only a small domain inventory and supported public tracking IDs to recognise exact matches across later scans. It is not tied to the visitor who requested the scan. See exactly what we keep.
Every scanner and all 194 checks are free for scans of up to 25 pages, which is enough to find the patterns your templates repeat. A paid plan exists for the case a sample cannot answer: A full audit of a whole site, every scanner in one run, as one downloadable report.
Checks follow the RFCs, the W3C specifications and the vendors\' own documentation, and each check page cites the source it is tested against. Where a check is a judgement call rather than a standard, the page says so.
Frequently asked questions
Is Scan.now safe to use on my own website?
The general website tools are read-only. Dedicated active tools send bounded, check-specific probes only after a registered user confirms authorisation. They never guess passwords, submit forms, extract data or modify the site.
Do you store the files I upload to the file scanner?
No. Files are analysed in memory and discarded when the response is sent. We keep only the file's SHA-256 hash and the verdict, so a known-bad file can be recognised instantly next time.
Can I scan a website I do not own?
The general website tools perform read-only public checks, but the LLM exposure scanner and its bulk/private modes require ownership or explicit permission because they probe additional leak-prone paths. The reports are for defenders: use them to fix sites you operate or are authorised to assess.
Why is my browser fingerprint 'unique'?
Fingerprinting combines dozens of details (screen size, fonts, graphics card, time zone, language) into an identifier. Most combinations are rare. Our guide on browser fingerprinting explains what reduces it and what makes it worse.
Is Scan.now free?
Passive tools can be started without a plan. Active website checks require a registered, authorised user, and their results and evidence are Premium-only. Reports are kept for 30 days.
