Sitemap | Scan.now

Scanners

Every tool, each with its own checks reference and guides.

Websites Website Vulnerability ScannerHeaders, TLS, cookies, exposed files Browsers Browser Security & Privacy CheckFingerprint, leaks, version, policies Files File Malware ScannerMalware in documents and archives Websites SSL / TLS CheckerCertificate, expiry, protocols, ciphers Websites Security Headers CheckerCSP, HSTS, frame and MIME policies Websites Email Security Checker (SPF, DKIM, DMARC)SPF, DKIM, DMARC and MX records Websites WordPress Vulnerability ScannerPlugins, themes, core and known CVEs Websites JavaScript Library Vulnerability ScannerOutdated libraries with known CVEs Privacy Phishing URL CheckerLookalike domains and hidden redirects Privacy Password Strength & Breach CheckerBreach lookup and strength analysis Browsers Browser Extension AnalyzerPermissions, host access, remote code Browsers WebRTC & IP Leak TestReal IP exposure behind a VPN Websites SEO & Site Health AuditCrawl, titles, links, speed, structured data

Checks reference

One page per check: What is tested, why it matters and the fix.

Checks index

File structure and malware indicators 20

Extension permissions and behaviour 9

Extension can read and change data on all websites Extension requests high-risk permissions Extension loads or evaluates remote code Content scripts injected into every page Extension contacts external endpoints Extension weakens its Content-Security-Policy Extension uses Manifest V2 Extension code is obfuscated Extension declares optional permissions

URL and phishing indicators 13

Internationalised (punycode) domain Lookalike of a well-known brand domain URL uses a raw IP address as host URL shortener hides the destination Brand name used in a subdomain or path Excessive subdomain depth Top-level domain heavily abused for phishing Long or cross-domain redirect chain Credentials or @ embedded in the URL Page asks for credentials Link uses plain HTTP Domain registered very recently Google Safe Browsing blocklist

Password security 3

Password found in a known data breach Password is weak Password follows a predictable pattern

Indexing and crawlability 10

robots.txt present and usable XML sitemap published and declared Sitemap URLs are live and indexable Pages excluded with noindex Linked pages blocked by robots.txt Canonical URL missing Canonical points to another URL Crawl errors (4xx / 5xx)Redirect chains Redirect loops

Titles, headings and content 13

Page title missing Title length outside the useful range Duplicate titles across pages Meta description missing Meta description length Duplicate meta descriptions H1 missing More than one H1 Heading levels skipped Thin content Duplicate body content Title does not match the page's own words Reading difficulty

Links and site structure 7

Broken internal links Generic or empty anchor text Orphan pages Pages buried deep in the structure Internal links marked nofollow Pages with little internal link support Internal anchor text repetition

Images and page weight 3

Images without alt text Oversized HTML documents Images not lazy-loaded

Technical SEO and speed 7

Viewport meta tag missing Language attribute missing HTML served uncompressed No cache policy on HTML Slow server response Render-blocking scripts in the head http:// references on HTTPS pages

Structured data and social 4

Structured data (JSON-LD) missing or invalid Open Graph tags missing Twitter card missing Site icon missing

International targeting 3

hreflang annotations invalid hreflang return links missing Language declarations disagree

Guides

Four topic hubs and their spokes.

All guides

Pillar 1

The Complete Guide to Security Scanning: Browsers, Websites, Files and Privacy

Browser Security 12

Browser Security: How Your Browser Is Attacked, Tracked and Hardened Browser Fingerprinting Explained: How Sites Identify You Without Cookies Is My Browser Secure? A Practical Checklist Browser Security Settings That Actually Matter (Chrome, Firefox, Safari, Edge)Are Browser Extensions Safe? How to Audit What You Have Installed WebRTC Leaks: How Your Browser Can Expose Your Real IP Behind a VPN Cookies Explained: First-Party, Third-Party, SameSite and the Flags That Protect Them Why Browser Updates Matter: Zero-Days, Patch Gaps and Auto-Update HTTPS-Only Mode: What It Protects and Why You Should Turn It On What Private Browsing Does and Does Not Hide Secure DNS (DoH and DoT): Stopping Your ISP and Network From Seeing Every Site You Visit Are Browser Password Managers Safe? Built-In vs Dedicated Managers

Website Security 22

Website Security: What a Vulnerability Scan Looks For and How to Fix It What Is a Vulnerability Scan? Types, Limits and What the Results Mean Passive vs Active Scanning: What Each Can Find and When Each Is Appropriate HTTP Security Headers Explained: Every Header, What It Blocks and How to Set It Content Security Policy (CSP): A Practical Guide to Writing One That Works HSTS Explained: Strict-Transport-Security, Preloading and the Downgrade Attacks It Stops SSL and TLS Explained: Certificates, Handshakes, Protocol Versions and Cipher Suites TLS Certificate Errors Explained: Expired, Mismatched, Self-Signed and Untrusted Chains The OWASP Top 10 Explained in Plain Language Cross-Site Scripting (XSS) Explained: Reflected, Stored, DOM-Based and How to Prevent It SQL Injection Explained: How It Works, Real Consequences and How to Prevent It Outdated JavaScript Libraries: Why Old jQuery and Angular Are a Real Risk and How to Find Them Subresource Integrity (SRI): Protecting Your Site From a Compromised CDN Cookie Security Flags: Secure, HttpOnly, SameSite and Cookie Prefixes Mixed Content: Why an HTTPS Page Loading HTTP Resources Is Still Insecure SPF, DKIM and DMARC Explained: Stopping Email Spoofing of Your Domain Exposed Files: .git, .env, Backups and Debug Pages That Leak Your Site's Secrets Clickjacking Explained: How Invisible Frames Hijack Clicks and How to Prevent It Scanning a WordPress Site for Vulnerabilities: What Attackers Look For First CVE and CVSS Explained: How Vulnerabilities Are Named, Scored and Prioritised Open-Source Security Scanners Compared: Nuclei, ZAP, OpenVAS, testssl.sh, Retire.js and ClamAV How to Read a Security Scan Report: Severity, False Positives and What to Fix First

Malware & File Safety 13

Malware and File Scanning: How Scanners Detect Viruses, Trojans and Malicious Documents How Antivirus and Malware Scanning Actually Works Signature vs Heuristic vs Behavioural Detection: How Malware Scanners Differ File Hashes Explained: MD5, SHA-1, SHA-256 and How They Identify Malware The EICAR Test File: Safely Testing Whether Your Scanner Works Malicious PDF Files: How a Document Runs Code and How to Check One Office Macro Malware: Why 'Enable Content' Is Still the Most Dangerous Button Disguised Files: Double Extensions, Fake Icons and Executables Pretending to Be Documents Archives and Zip Bombs: Why Compressed Files Need Their Own Scan ClamAV Explained: The Open-Source Antivirus Engine and What Its Verdicts Mean Is This File Safe? A Step-by-Step Way to Judge a File Before Opening It How to Scan Downloads Before Opening Them (and What Your Browser Already Does)Malware Types Explained: Viruses, Worms, Trojans, Ransomware, Spyware and Infostealers

Privacy & Security 12

Online Privacy and Security: Tracking, Leaks, Passwords and Phishing How Online Tracking Works: Cookies, Pixels, Fingerprints and Data Brokers How Ad Blockers and Tracker Blockers Work (and Why Manifest V3 Changed Them)Automatically Deleting Cookies: Why It Cuts Tracking and How to Set It Up VPN vs Proxy vs Tor: What Each Hides, What Each Leaks What Your IP Address Reveals and How Sites Use It Password Security: Length, Reuse, Breaches and How Passwords Are Actually Cracked Two-Factor Authentication: SMS vs Authenticator Apps vs Passkeys and Security Keys How to Spot Phishing: URLs, Lookalike Domains, Urgency and the Checks That Work Your Data Was in a Breach: What to Do in the First Hour, Day and Week Data Brokers: Who Has Your Personal Information and How to Get It Removed Do Not Track vs Global Privacy Control: Which Signal Sites Actually Have to Honour

Blog

All posts

Ethical Hacking: What It Is and How to Start Passive vs Active Scanners: Why We Never Attack Scan.now vs Mozilla HTTP Observatory Scan.now vs Sucuri SiteCheck Compared Scan.now vs securityheaders.com Compared Scan.now vs SSL Labs: Which TLS Test to Use

Reference and policies

Search What we check All tools Guides Blog How we scan Certificate authorities Browser extension Pricing About Editorial policy Responsible disclosure Contact Privacy policy Terms of use

Crawlers want the XML sitemap; this page is for people. Looking for something specific? Search the site.

Every page on Scan.now