Check a site, browser or file for security problems

How to choose the right scanner

The 31 tools in the directory above answer different questions. The short version: Scan a site when you control it and want to know what a stranger can see; scan your browser when you want to know what every site you visit can see about you; scan a file or a link when something arrived and you do not trust it.

You own the website

Start with the website vulnerability scanner for passive headers, TLS, cookies, exposed files and outdated JavaScript. Then use the dedicated authorised tests when the application accepts input: the XSS scanner, SQL injection scanner, open redirect scanner, and the rest of the Active Security section above. If the site calls an AI model, run the LLM API key scanner; if it is WordPress, use the WordPress scanner. For search visibility, use the SEO and site health audit, identify the public platform with the tech stack scanner, and compare link-graph connectivity with the Common Crawl Harmonic Centrality checker.

You want to know what your browser gives away

The browser security check runs inside the browser you are reading this in: Version currency, fingerprint uniqueness, cookie and storage behaviour, and which protections are switched on. The WebRTC leak test answers the narrower question of whether your VPN is actually hiding your address, and the extension analyzer tells you what an extension can read and change once installed.

Something arrived and you do not trust it

For an attachment, the file malware scanner analyses it in memory and never writes it to disk. For a link, the phishing URL checker opens it from our server instead of your browser and tells you where it actually ends up. If you have already typed a password somewhere you should not have, the password breach check tells you whether it is in the public breach corpora, without the password leaving your browser.

What they all have in common

Every tool states what it sends before it runs. Passive tools fetch and inspect; active tools use bounded check-specific probes only after the user confirms authorisation. No active check extracts data, submits a form or changes the site. Every finding links to its own reference page, and how we scan sets out exactly what happens on the wire.