scan.now
Premium Scan a site

Every check we run, explained.

A scanner that reports “missing header” without saying why is noise. Each of the 179 checks below has its own page: Exactly what is tested, the attack it relates to, how severe it is, and configuration you can paste to fix it.

Transport security (HTTPS / TLS)HTTP security headersCookie securityPage content and JavaScriptExposed files and information disclosureDNS and email authenticationWordPress plugins, themes and coreBrowser privacy and policy enforcementFile structure and malware indicatorsExtension permissions and behaviourURL and phishing indicatorsPassword securityIndexing and crawlabilityTitles, headings and contentLinks and site structureImages and page weightTechnical SEO and speedStructured data and socialInternational targeting
Illustration of the Scan.now checks reference showing findings and their severities

Transport security (HTTPS / TLS)

Run by the Website Vulnerability Scanner.

12 checks
Critical Certificate chain and hostname validationThe certificate presented for this hostname did not validate: The chain does not reach a trusted root, an... Critical HTTPS is availableThe site could not be reached over HTTPS on port 443, or the TLS handshake failed. Everything it serves travels in... High Certificate expiryThe certificate has expired or will expire within 30 days. Once it lapses every browser, API client and mail gateway... High Deprecated TLS versions accepted (1.0 / 1.1)The server still completes handshakes with TLS 1.0 or TLS 1.1. Both were formally deprecated by RFC 8996 in 2021 and... High HTTP redirects to HTTPSPort 80 serves page content instead of redirecting to HTTPS, or the redirect chain is wrong. Visitors who type the... Medium Certificate key strengthThe certificate's public key is weaker than current guidance: An RSA key shorter than 2048 bits, or a DSA key. Such... Medium Certificate signature algorithmA certificate in the chain is signed with SHA-1, MD5 or another broken hash. Browsers reject SHA-1-signed... Medium Strict-Transport-Security (HSTS)The HTTPS response carries no Strict-Transport-Security header, or its max-age is too short to protect returning... Medium Weak cipher suites acceptedThe server is willing to negotiate legacy cipher suites such as RC4, 3DES, export-grade, NULL or anonymous suites,... Low TLS 1.3 supportThe server negotiates TLS 1.2 at best and does not offer TLS 1.3. This is not a vulnerability on its own, but it... Info HSTS preload eligibilityThe domain does not yet meet the requirements for the browser HSTS preload list. Preloading is optional, so this is... Info HTTP/2 supportThe server negotiates only HTTP/1.1 over TLS and does not advertise HTTP/2. This is a performance and modernity...

HTTP security headers

Run by the Website Vulnerability Scanner.

13 checks
High CORS allows arbitrary origins with credentialsThe server reflects any Origin in Access-Control-Allow-Origin while also sending Access-Control-Allow-Credentials:... Medium Clickjacking protection (X-Frame-Options / frame-ancestors)The page can be embedded in a frame on any other site. An attacker can overlay your buttons with invisible decoys... Medium Content-Security-Policy is weakA Content-Security-Policy exists but contains directives that let injected script run anyway: 'unsafe-inline'... Medium Content-Security-Policy missingThe page is served without an enforced Content-Security-Policy. If an attacker finds any way to inject markup, the... Low Cross-Origin-Opener-PolicyThe page does not set Cross-Origin-Opener-Policy, so windows it opens, or that open it, from other origins keep a... Low Permissions-PolicyNo Permissions-Policy header restricts powerful browser features. Any script on the page, including third-party... Low Referrer-PolicyNo Referrer-Policy is set, or it is set to a value that sends full URLs to other sites. Paths and query strings,... Low Server version disclosureThe Server header reveals the exact web server software and version, such as Apache/2.4.58 (Ubuntu) or nginx/1.24.0,... Low X-Content-Type-Options: nosniffResponses lack X-Content-Type-Options: Nosniff, so browsers may guess a content type and execute a file as script or... Low X-Powered-By technology disclosureAn X-Powered-By or similar header announces the application platform and often its version (PHP/8.1.2, ASP.NET,... Info Cache-Control on pages that set cookiesA response that sets cookies, and is therefore personalised, does not tell caches to keep out. A shared cache could... Info Cross-Origin-Resource-PolicyResponses do not carry Cross-Origin-Resource-Policy, so other origins may embed them as scripts, images or fetches... Info X-XSS-Protection (deprecated header)The response sets X-XSS-Protection to 1 or 1; mode=block. No current browser implements the filter it controls, and...

Cookie security

Run by the Website Vulnerability Scanner.

4 checks
Medium Cookie without HttpOnly flagA cookie is readable by JavaScript because it lacks the HttpOnly attribute. Any script injected into the page, or... Medium Cookie without Secure flagA cookie is set without the Secure attribute, so the browser will also send it over plain HTTP. An attacker who can... Low Cookie without SameSite attributeA cookie is set without a SameSite attribute, or with SameSite=None but no Secure flag. Depending on the browser, it... Info Cookie name prefixes (__Host- / __Secure-)Session cookies do not use the __Host- or __Secure- name prefixes, so a subdomain, an HTTP origin or a lookalike...

Page content and JavaScript

Run by the Website Vulnerability Scanner.

10 checks
High Form submits over HTTPA form on the page submits to a plain-HTTP URL. Whatever the user types, including passwords and card numbers,... High JavaScript library with known vulnerabilitiesThe page loads a JavaScript library version with published vulnerabilities. Whether it is exploitable depends on how... High Mixed content (HTTP resources on an HTTPS page)The HTTPS page loads scripts, styles, frames or media over plain HTTP. Active mixed content is blocked by browsers... Low Advertising and tracking endpointsWhich of the page's third-party hosts exist to advertise to the visitor or to follow them, matched against the... Low CMS / generator version disclosureThe page announces the CMS or static-site generator it was built with, usually including the version, in a meta tag,... Low Sensitive information in HTML commentsHTML comments in the page source contain material that looks internal: Credentials, TODO notes, internal hostnames... Low Third-party scripts without Subresource IntegrityScripts or stylesheets are loaded from third-party hosts without an integrity attribute. If that host is compromised... Info Inline event handlers and scriptsThe page relies on inline scripts, on* event-handler attributes or javascript: URLs. These are not vulnerabilities... Info Password field autocompletePassword fields on the page either try to disable autocomplete, which browsers ignore and password managers dislike,... Info Third-party script inventoryAn inventory of every script the page loads from other domains. This is informational, but each host on the list...

Exposed files and information disclosure

Run by the Website Vulnerability Scanner.

14 checks
Critical Exposed .env configuration fileA .env configuration file is served from the web root. These files hold database passwords, API keys, mail... Critical Exposed .git repositoryThe site's .git directory is reachable over HTTP. Anyone can reconstruct the full source repository, including... High Exposed backup or archive filesA backup archive, database dump or editor backup copy of a configuration file is downloadable from the web root,... High Exposed phpinfo() pageA phpinfo() page is publicly reachable. It prints the PHP version, every loaded module, configuration paths, and... Medium Directory listing enabledThe web server generates an index of files for a directory that has no index page, exposing every file in it,... Medium Exposed server status pageA server status page (Apache mod_status, nginx stub_status or PHP-FPM status) is reachable from the internet,... Medium WordPress user enumeration via REST APIThe WordPress REST API or author archives reveal account usernames to anonymous visitors, giving attackers half of... Medium WordPress xmlrpc.php enabledThe WordPress XML-RPC endpoint at /xmlrpc.php is enabled. It allows hundreds of login attempts per request through... Low Exposed .DS_Store fileA macOS .DS_Store file is served from the web root. It lists the names of files and folders in that directory,... Low HTTP TRACE method enabledThe server answers HTTP TRACE requests by echoing them back. The method has no legitimate use on a production site... Low WordPress version disclosureThe site runs WordPress and reveals its exact core version through the generator tag, asset query strings,... Info Redirect parameters on the pageLinks or forms on the page carry parameters whose names and values suggest a redirect target (next=, return_to=,... Info robots.txt reviewA review of robots.txt. The file is public and advisory, so Disallow lines that name private or administrative paths... Info security.txt (RFC 9116) presentNo security.txt file was found at /.well-known/security.txt, or the one present is invalid or expired. Researchers...

DNS and email authentication

Run by the Website Vulnerability Scanner.

8 checks
High SPF record is too permissiveThe SPF record ends in +all or ?all, omits the all mechanism, or authorises very large address ranges, so a forged... Medium DMARC recordNo DMARC record is published at _dmarc.<domain>, or the record is malformed. Receivers have no instruction on what... Medium SPF recordThe domain publishes no valid SPF record, or publishes more than one, so receiving mail servers cannot tell which... Low CAA recordNo CAA record limits which certificate authorities may issue certificates for the domain, so any of the hundred-plus... Low DMARC policy is p=none (monitoring only)The DMARC record exists but uses p=none, so receivers are asked to deliver spoofed mail normally. Monitoring is the... Low DNSSEC signingThe domain's DNS zone is not signed with DNSSEC, so a resolver cannot verify that the answers it receives for your... Info DKIM selector discoveredNo DKIM public key was found under the common selector names, or the key found is weak or revoked. Without DKIM,... Info MX recordsA review of the domain's MX records: Whether mail is deliverable, whether every mail host resolves, and whether a...

WordPress plugins, themes and core

Run by the Website Vulnerability Scanner.

10 checks
Critical WordPress install or upgrade script reachableThe WordPress installer or database upgrader answers with its setup page instead of 'already installed'. On an... High Exposed wp-content/debug.logThe WordPress debug log at /wp-content/debug.log is readable by anyone. It contains PHP notices with absolute server... High Plugin version with known vulnerabilitiesAt least one installed plugin is at a version with published vulnerabilities. Plugin flaws are the most common way... High Theme version with known vulnerabilitiesThe identified theme is at a version with published vulnerabilities. Theme code runs with full application... High WordPress core version has known vulnerabilitiesThe WordPress core version on this site falls inside the affected range of at least one published vulnerability.... Info Installed plugins identifiedInstalled plugins were identified from the REST API route index and from asset paths in the page, with versions read... Info Installed themes identifiedThe active theme (and its parent, if it is a child theme) was identified from asset paths in the page, with the... Info REST API route index publicly readableThe REST API index at /wp-json/ lists every registered namespace and route to anonymous visitors. This is... Info WordPress core version identifiedThe exact WordPress core version could be read from the page or from readme.html. The version itself is recorded... Info WordPress detectedThe site runs WordPress. That is not a weakness by itself, but it means the plugin, theme and core-version checks...

Browser privacy and policy enforcement

Run by the Browser Security & Privacy Check.

16 checks
High Browser enforces Content-Security-PolicyYour browser ran an inline script on a page whose Content-Security-Policy forbids it, so the cross-site scripting... High Browser version is out of dateYour browser is behind the current stable release, so it is missing security fixes for bugs that attackers already... High WebRTC IP address leakWebRTC revealed an IP address that differs from the one your connection uses, typically your real address behind a... Medium Browser enforces X-Content-Type-OptionsYour browser executed a script that was served with a non-script content type and X-Content-Type-Options: Nosniff,... Medium Browser enforces X-Frame-OptionsYour browser displayed a page inside a frame even though that page was served with X-Frame-Options: DENY, so the... Medium Browser fingerprint uniquenessThe combination of signals your browser exposes matched no other visitor in our sample, so it could be used to... Medium Third-party cookies allowedYour browser accepts cookies set by third-party domains embedded in other sites, which is the basic mechanism of... Low Browser defaults cookies to SameSite=LaxYour browser sent a cookie that has no SameSite attribute on a cross-site request, so it does not apply the Lax... Low Canvas fingerprinting exposureYour browser renders a hidden test image identically every time and lets scripts read the pixels back, so the result... Low Full referrer sent cross-siteWhen you follow a link to another site, your browser sends the full address of the page you came from, including its... Low Global Privacy Control signalYour browser is not sending the Global Privacy Control signal, so sites that are legally required to honour opt-outs... Low WebGL renderer exposureScripts can read your graphics card model and driver details through WebGL, a strong and long-lived identifying signal. Info Do Not Track signalYour browser is not sending the DNT: 1 header. Most sites ignore the signal in any case, so this is informational. Info Hardware details exposed to scriptsScripts on any page can read your CPU core count, approximate memory, screen geometry, touch capability and in some... Info JavaScript disabledJavaScript is off in your browser, so the client-side parts of this scan could not run. That is a strong privacy... Info User-Agent Client Hints exposureYour browser answers high-entropy Client Hints requests, revealing its exact version, platform version, device model...

File structure and malware indicators

Run by the File Malware Scanner.

20 checks
Critical Known malware signature matchThe file matched a known malware signature, in our own signature set or in the local antivirus daemon when one is... Critical Script contains download-and-execute commandsThe script contains commands that download and execute code or tamper with system defences, such as PowerShell IEX... High Archive contains an executableThe archive holds an executable, installer, script or shortcut, the standard way to get a program past an email... High Decompression bombThe archive declares an uncompressed size vastly larger than its compressed size, so extracting it could fill your... High Double file extensionThe filename has a document-looking extension in front of a final executable one, such as invoice.pdf.exe, a... High Executable embedded inside another fileAn executable program is embedded inside a file of another type, such as a Windows binary hidden in a PDF, an Office... High File content does not match its extensionThe bytes inside the file identify a different format from the one its extension claims, such as a Windows program... High HTML file assembles a download in the browserThe HTML file assembles a download inside the browser from encoded data using JavaScript, delivering a payload that... High Obfuscated or encoded scriptThe script's code is deliberately hard to read: Encoded strings, character-code arrays or packed layers that hide... High Office document contains macrosThe Office document contains VBA macro code, which runs with your user privileges as soon as you click Enable Content. High Office document loads a remote templateThe document is attached to a template at a remote address, so opening it silently fetches content from an external... High PDF contains JavaScriptThe PDF contains JavaScript, which Adobe Acrobat and some other readers execute when the document opens or when an... High PDF contains launch or open actionsThe PDF contains an action that fires when the file opens or when you interact with it, such as launching a program,... High Windows shortcut (.lnk) fileThe file is a Windows shortcut (.lnk), which can run any command line under any icon and any name, and is a... Medium Deeply nested archiveThe archive contains further archives several levels deep, a structure used to exhaust scanners and to strip the... Medium Executable program fileThe file is an executable program (Windows PE, macOS Mach-O, Linux ELF, an installer or a script) that will run with... Medium PDF contains embedded filesThe PDF carries one or more attached files inside it, which can be executables, scripts or further documents that a... Medium Password-protected archiveThe archive's contents are encrypted with a password, so neither Scan.now nor your antivirus can inspect what is... Info EICAR antivirus test fileThe file contains the EICAR test string, a harmless sequence that every antivirus engine is required to detect. It... Info File hash reputationScan.now computed the file's SHA-256 (plus MD5 and SHA-1 for comparison with older feeds) and compared it with the...

Extension permissions and behaviour

Run by the Browser Extension Analyzer.

9 checks
Critical Extension loads or evaluates remote codeThe extension fetches and executes code from a server at runtime, so what it does can change at any moment without a... High Extension can read and change data on all websitesThe extension asks for access to every website, so it can read and change everything you see and type in the browser. High Extension code is obfuscatedThe extension's JavaScript is obfuscated rather than merely minified, which hides its behaviour from reviewers and... High Extension requests high-risk permissionsThe extension requests permissions that reach beyond the page: Intercepting requests, reading cookies or history,... Medium Content scripts injected into every pageThe extension injects its own script into every page you open, whether or not you use it there. Medium Extension contacts external endpointsThe extension's code contains addresses of external servers it communicates with, so some of your data or activity... Medium Extension weakens its Content-Security-PolicyThe extension's content_security_policy loosens the default protections, permitting inline scripts, eval or remote... Low Extension uses Manifest V2The extension still declares manifest_version 2, a format Chrome no longer runs and that lacks the stricter code and... Info Extension declares optional permissionsThe extension declares optional permissions or optional host permissions that it can request later at runtime. This...

URL and phishing indicators

Run by the Phishing URL Checker.

13 checks
Critical Google Safe Browsing blocklistGoogle Safe Browsing lists this URL as phishing, malware or unwanted software. This is the strongest signal Scan.now... High Brand name used in a subdomain or pathA well-known brand name appears in the subdomain or path of a URL whose registered domain is something else, for... High Credentials or @ embedded in the URLThe URL contains a user:password@ section before the host, a legacy syntax that phishers use to make an address... High Internationalised (punycode) domainThe domain contains internationalised (non-ASCII) characters encoded as punycode (xn--), which can make a lookalike... High Lookalike of a well-known brand domainThe registered domain closely resembles a well-known brand's domain through a typo, an inserted character, a swapped... Medium Domain registered very recentlyThe domain was registered very recently, which is typical of phishing infrastructure that is created, used for days... Medium Link uses plain HTTPThe link uses plain http://, so anything you send to the page, including a password, would travel unencrypted, and... Medium Long or cross-domain redirect chainFollowing the link produced several redirects, or a redirect onto a different domain, so where you land is not where... Medium Page asks for credentialsThe page at the link asks for a username and password, so if anything else about the URL is off, this is where the... Medium URL uses a raw IP address as hostThe link points to a bare IP address instead of a domain name, which legitimate consumer services almost never do. Low Excessive subdomain depthThe host has an unusually deep chain of subdomains, a pattern used to push the real domain out of sight and to mint... Low Top-level domain heavily abused for phishingThe domain ends in a top-level domain that is disproportionately used for phishing and spam, usually because... Low URL shortener hides the destinationThe link goes through a URL-shortening service, so the real destination is hidden until you click.

Password security

Run by the Password Strength & Breach Checker.

3 checks
Critical Password found in a known data breachThis exact password appears in Have I Been Pwned's Pwned Passwords corpus of real breach data, so attackers already... High Password is weakThe password can be guessed quickly: It is short, drawn from a small character set, or built from dictionary words... Medium Password follows a predictable patternThe password follows a structure people use constantly, such as a word plus a year, a capital first letter with a...

Indexing and crawlability

Run by the SEO & Site Health Scanner.

10 checks
High Crawl errors (4xx / 5xx)URLs reached during the crawl that returned a client or server error. Every one is a dead end for a visitor and for... High Pages excluded with noindexA noindex directive removes a page from search results entirely. Applied by accident, it is the fastest way to lose traffic. High Redirect loopsA URL that redirects back to something already in its own chain never resolves. The page is unreachable for everyone. Medium Canonical URL missingA canonical link tells search engines which URL is the real one when the same content is reachable at several addresses. Medium Canonical points to another URLA canonical pointing at a different URL asks search engines to index that URL instead of this one. Correct for... Medium Linked pages blocked by robots.txtA page you link to internally but disallow in robots.txt sends contradictory signals and wastes the link. Medium Redirect chainsA URL that reaches its destination through two or more redirects costs every visitor and every crawler extra round trips. Medium Sitemap URLs are live and indexableEvery URL in a sitemap is a claim that the page exists and should be indexed. We cross-check the URLs we also... Medium XML sitemap published and declaredAn XML sitemap lists the URLs you want crawled and when they last changed. Search engines use it to find pages that... Medium robots.txt present and usablerobots.txt is the first file a crawler asks for. It sets crawl rules for the whole site and is where a sitemap is...

Titles, headings and content

Run by the SEO & Site Health Scanner.

13 checks
High Duplicate body contentTwo pages with identical body text are one page at two addresses, and search engines will pick one of them for you. High Page title missingThe title element is the headline of every search result and the label on every browser tab. A page without one has no name. Medium Duplicate titles across pagesTwo pages with the same title compete for the same queries and give searchers no way to tell them apart. Medium H1 missingThe H1 is the page's visible headline. Its absence usually means the page has no clear subject in its own markup. Medium Meta description missingThe meta description is the snippet under the headline. Without one, the engine writes it for you from whatever text... Medium Thin contentPages with very little body text rarely satisfy the query that brought someone to them, and rarely rank for anything... Medium Title length outside the useful rangeTitles are truncated in search results at roughly 600 pixels. Too long and the end is cut; too short and the page... Low Duplicate meta descriptionsThe same description on many pages tells a searcher nothing about which one to open. Low Heading levels skippedHeading levels should descend one at a time. Jumping from H2 to H4 leaves a hole in the document outline. Low Meta description lengthDescriptions much shorter than 70 characters waste the space; much longer than 160 are cut off mid-sentence. Low More than one H1Several H1s on one page split its subject. HTML5 permits it; readers and assistive technology still do better with one. Info Reading difficultyHow hard the page is to read, measured rather than guessed: Sentence length, word length and the Flesch score they produce. Info Title does not match the page's own wordsIf none of a page's most frequent words appear in its title, the title and the content are describing different things.

Images and page weight

Run by the SEO & Site Health Scanner.

3 checks
Medium Images without alt textAlt text is what a screen reader announces and what an image search engine reads. Without it an image is invisible to both. Medium Oversized HTML documentsA very large HTML document delays rendering and can be truncated by crawlers before the end of the page is read. Low Images not lazy-loadedImages below the fold that load immediately compete for bandwidth with the content the reader can actually see.

Technical SEO and speed

Run by the SEO & Site Health Scanner.

7 checks
High Viewport meta tag missingWithout a viewport meta tag, mobile browsers render the page at desktop width and shrink it. Google indexes the... Medium HTML served uncompressedHTML served without gzip or brotli transfers several times more bytes than it needs to. Medium Render-blocking scripts in the headSynchronous scripts in the head stop the parser. Everything below them waits, including the text the reader came for. Medium Slow server responseHow long the server took to return each page. Slow responses delay everything that follows and limit how much of the... Medium http:// references on HTTPS pagesLinks from an HTTPS page to http:// URLs cost a redirect on every click and expose the first request. Low Language attribute missingThe lang attribute on <html> tells screen readers which pronunciation to use and search engines which language to... Info No cache policy on HTMLHTML with no cache policy is re-downloaded in full on every visit, including every back-button navigation.

Structured data and social

Run by the SEO & Site Health Scanner.

4 checks
Medium Structured data (JSON-LD) missing or invalidStructured data describes a page in a vocabulary search engines parse directly. Without it, no rich result is possible. Low Open Graph tags missingOpen Graph tags decide how a link looks when it is shared. Without them, a shared page is a bare URL. Info Site icon missingThe site icon appears in tabs, bookmarks, history and increasingly in search results themselves. Info Twitter card missingA twitter:card tag selects the card format on X. Without one, the platform falls back to Open Graph.

International targeting

Run by the SEO & Site Health Scanner.

3 checks
Medium Language declarations disagreePages declaring different languages with nothing connecting them leaves search engines guessing which version... Medium hreflang annotations invalidhreflang tells search engines which language and region each version of a page is for. Invalid codes are ignored silently. Medium hreflang return links missinghreflang must be reciprocated. If page A names B but B does not name A, search engines ignore the whole annotation.