scan.now
Premium Scan a site

Check Web Forms for Missing CSRF Protection

Enter a page containing forms. Scan.now inventories its POST forms and identifies those without a recognisable anti-CSRF token field; no form is submitted.

Enter the exact public page to inspect. No form is submitted and no data is modified.

A registered account is required to run this test. Finding status, evidence, affected locations and remediation are Premium-only. How active scanning works · Acceptable use

What the CSRF form review can tell you without submitting anything

Cross-site request forgery abuses a browser that is already authenticated. Another site causes that browser to send a state-changing request, and the target application mistakes the attached session cookie for proof that the user intended the action.

Scan.now inventories public POST forms and looks for recognisable anti-CSRF hidden fields. It never submits a form. A missing field is a useful review signal, especially on account, billing and administration actions, but the scanner cannot see server-side Origin checks, custom request headers or whether a visible token is actually validated.

Put this result in context

This scanner answers one part of the review. Continue with Session URL Scanner for detect session ids and access tokens in query strings, then XSS Scanner for confirm reflected script injection in a url parameter. These are separate checks because a strong result here does not prove that the adjacent surface is healthy.

For the background behind these signals, read Website Security: What a Vulnerability Scan Looks For and How to Fix It and What Is a Vulnerability Scan? Types, Limits and What the Results Mean. The POST form without recognisable CSRF protection check reference explains the exact test, evidence and remediation used in the report. The Scan.now methodology explains request limits, scan boundaries and what the scanner deliberately does not attempt.

POST forms and anti-forgery fields

The check is deliberately bounded to the signals below.

Coverage areaWhat the scanner examines
Public POST formsForm methods, actions, named fields, password presence and upload presence are recorded from the returned HTML.
Recognisable token fieldsNames containing csrf, xsrf, authenticity, request token or nonce are treated as visible token evidence.
Read-only inspectionNo button is pressed, no field is populated and no state-changing request is sent.

Missing, present and unverified protections

A scan result is evidence with a boundary, not a guarantee about every route.

Token field missing

Review whether the action changes state and whether the server enforces another robust request-origin control. Absence alone is not proof of exploitability.

Token field present

The form carries a recognisable token field. Confirm server-side validation, session binding, unpredictability and rotation in code or integration tests.

No POST form found

The page exposed no ordinary POST form. JavaScript fetch requests, JSON APIs and forms rendered after page load are not covered.

Tokens, SameSite cookies and origin checks

Use the recommendations below to address confirmed findings and strengthen the surrounding control.

  1. Use the framework's CSRF middleware

    Generate an unpredictable token tied to the user's session and validate it on every state-changing request.

  2. Validate Origin as a second signal

    For HTTPS requests, compare the Origin header with the expected origin and reject unexpected or missing values according to a documented policy.

  3. Set session cookies deliberately

    SameSite=Lax or Strict blocks many cross-site requests; keep Secure and HttpOnly as separate controls.

  4. Do not change state with GET

    Links and image loads are easy to trigger cross-site. Use POST, PUT, PATCH or DELETE plus CSRF protection for mutations.

  5. Require re-authentication for critical actions

    Password, MFA or transaction confirmation limits damage if a session or CSRF defence fails.

How it works

  1. Enter a page containing forms

    Use the public page where the account, contact, checkout or administration form is rendered.

  2. We inspect form structure

    POST actions and named fields are inventoried; no form data is submitted.

  3. Review missing-token signals

    The report identifies forms without a recognisable field and explains the server-side checks to confirm.

What this tool checks

1 checks across 1 areas. Each links to its reference page with the test, the risk and the fix.

Full reference

Page content and JavaScript

1 check

The ones that most often decide the grade:

Medium POST form without recognisable CSRF protectionA POST form has no recognisable anti-CSRF field.

Related tools

Continue the review with four checks that cover adjacent parts of the same attack surface.

All tools
Active Security Session Token URL Scanner

Detect session IDs and access tokens in query strings
Active Security XSS Vulnerability Scanner

Confirm reflected script injection in a URL parameter
Active Security Open Redirect Scanner

Check redirect and return URL parameters
Websites Website Vulnerability Scanner

Headers, TLS, cookies, exposed files

Guides for this tool

Background reading written to go with these results.

13 min read · Updated Sep 13, 2026 Website Security: What a Vulnerability Scan Looks For and How to Fix It

A website vulnerability scan checks the parts of a site an attacker can reach without logging in: Transport security, HTTP headers,...

Read the guide
8 min read · Updated Sep 12, 2026 What Is a Vulnerability Scan? Types, Limits and What the Results Mean

A vulnerability scan checks a system against a list of known weaknesses and reports what matches. The types of scan, the difference...

Read the guide
8 min read · Updated Sep 14, 2026 Passive vs Active Scanning: What Each Can Find and When Each Is Appropriate

Passive scanning observes normal responses; active scanning sends crafted requests to trigger flaws. The boundary, why it matters...

Read the guide
9 min read · Updated Sep 18, 2026 How to Read a Security Scan Report: Severity, False Positives and What to Fix First

A scan report is a list of findings with severities, and the hard part is deciding what matters. How severities are assigned, how to...

Read the guide

Frequently asked questions

Does SameSite mean I do not need CSRF tokens?

SameSite is valuable but browser behaviour, legacy clients, subdomain trust and application flows can weaken it. Use it with framework CSRF protection rather than as the only control.

Can Scan.now verify that a token works?

No. This public check does not submit forms. A developer test should confirm that missing, changed, expired and another user's token are all rejected.

Are login forms affected by CSRF?

Yes. Login CSRF can force a victim into an attacker-controlled account, causing later data to be saved in the wrong place. Protect authentication and account-linking flows too.

Why are JSON APIs different?

A cross-site HTML form cannot set application/json or arbitrary headers, so strict content types and custom headers help. CORS, simple content types and cookie authentication still need careful review.