Active scanners send real attack traffic at a site to see what breaks. Scan.now only looks at what the site already shows any visitor. Active scanning finds more, but you need permission and a maintenance window. Passive scanning is safe to run on anything, any time.
There are two ways to test a website, and the difference matters more than most people realise.
A passive scanner looks. It asks for the page the way your browser would, reads what comes back, and works things out from that.
An active scanner pokes. It sends unusual requests on purpose to see what breaks. Services that host tools like Nmap, OpenVAS and Nikto do this.
The line that actually matters
Scan.now is passive: it reads what your site already sends, so you can point it at anything — a live shop on a Friday, a supplier, a link somebody emailed you — without risk. An active scanner finds a different class of bug, and needs your own site and a maintenance window to do it safely.
What each approach can see
| Active scanning | Scan.now (passive) | |
|---|---|---|
| Open ports on the server | Yes | No |
| Bugs found by sending odd input | Yes | No |
| Headers, TLS, cookies | Some | Yes, in detail |
| Old software with known holes | Yes | Yes |
| Email spoofing protection | Rarely | Yes |
| Can it break something? | Yes, occasionally | No |
| Needs permission | Yes, in writing | No, for public pages |
| Shows up in logs as an attack | Yes | No |
Why passive can be pointed anywhere
You can run it on anything, today. Sending attack traffic at a site you do not own is, in most places, an attack. Reading the page your browser already loaded is not. No form is submitted, no password guessed, no payload sent.
It cannot take your site down. There is no maintenance window, no staging copy to stand up, nobody to warn. That is why it is the scan that actually gets run, and a scan that runs beats a better scan that does not.
Most real compromises start here anyway. Expired certificates, missing headers, readable .git folders, known-vulnerable libraries and out-of-date plugins are all visible without sending a single hostile byte — and they are what gets sites breached far more often than an exotic injection.
What active testing reaches that we do not
It finds what we cannot see: a database port open to the world, or a bug that only appears when a form is sent a strange value. If you own the site and can take the risk, an active scan reaches further — and you should run one.
Why we chose the safe half
Passive on purpose: a tool anyone can point at any address has to be one that cannot do damage. Our methodology page lists every request each scanner makes, so you can verify that rather than take our word for it. Start with the website scanner, fix what it finds, and bring in an active scanner for your own site when you have a window.
Questions about scanning safely
Is it legal to scan a site I do not own?
Passive checks are the ones your browser already performs, so running them is not an intrusion. That is a statement about the tool, not legal advice for your country. Active scanning is different and needs written permission. Our terms spell this out.
Will an active scan take my site down?
Usually not, occasionally yes. Old devices and small servers sometimes fall over under scanning traffic. Run one out of hours, with a backup.
Do I need both?
If you run the server, yes. Passive first, because it is free and instant and finds the common problems. Active later, when you can schedule it.
Also in this series: vs Sucuri SiteCheck, vs SSL Labs, vs Mozilla HTTP Observatory.