scan.now
Premium Scan a site

Scan a Website for Vulnerabilities

Enter a domain or URL. Scan.now fetches the page like a browser, opens TLS connections, looks up DNS and requests a fixed list of well-known paths. Sixty passive checks, graded A+ to F, each linked to an explanation and a fix.

Public hosts only. About 30 requests, usually finished in under 15 seconds. How we scan · Acceptable use

Illustration of the website vulnerability scanner in use

How it works

  1. Enter the address

    Type a domain such as example.com or a full URL. Private and internal addresses are refused.

  2. We run 60 passive checks

    Transport security, headers, cookies, page content, exposed files and DNS, in parallel, usually in under 15 seconds. Switch to a deep scan and the page-level checks run on every page we crawl, not only the one you entered.

  3. Read the graded report

    Findings are sorted by severity with evidence and a link to the fix. Share the report by link for 30 days.

What this tool checks

61 checks across 6 areas. Each links to its reference page with the test, the risk and the fix.

Full reference

Page content and JavaScript

10 checks

Cookie security

4 checks

DNS and email authentication

8 checks

Exposed files and information disclosure

14 checks

HTTP security headers

13 checks

Transport security (HTTPS / TLS)

12 checks

The ones that most often decide the grade:

Critical HTTPS is availableThe site could not be reached over HTTPS on port 443, or the TLS handshake failed. Everything it serves travels in... High HTTP redirects to HTTPSPort 80 serves page content instead of redirecting to HTTPS, or the redirect chain is wrong. Visitors who type the... High Deprecated TLS versions accepted (1.0 / 1.1)The server still completes handshakes with TLS 1.0 or TLS 1.1. Both were formally deprecated by RFC 8996 in 2021 and... Critical Certificate chain and hostname validationThe certificate presented for this hostname did not validate: The chain does not reach a trusted root, an... High Certificate expiryThe certificate has expired or will expire within 30 days. Once it lapses every browser, API client and mail gateway... High CORS allows arbitrary origins with credentialsThe server reflects any Origin in Access-Control-Allow-Origin while also sending Access-Control-Allow-Credentials:...

Wondering how this stacks up against the tool you already use? We wrote up how this compares with Sucuri SiteCheck, including the things it does better than us.

After this one, most people run SSL / TLS Checker, Security Headers, or Email (SPF, DKIM, DMARC). Each answers a different question about the same thing, and the full list of tools explains which to reach for when. Every finding links through to the checks reference.

Guides for this tool

Background reading written to go with these results.

13 min read · Updated Sep 13, 2026 Website Security: What a Vulnerability Scan Looks For and How to Fix It

A website vulnerability scan checks the parts of a site an attacker can reach without logging in: Transport security, HTTP headers,...

Read the guide 8 min read · Updated Sep 12, 2026 What Is a Vulnerability Scan? Types, Limits and What the Results Mean

A vulnerability scan checks a system against a list of known weaknesses and reports what matches. The types of scan, the difference...

Read the guide 9 min read · Updated Sep 18, 2026 How to Read a Security Scan Report: Severity, False Positives and What to Fix First

A scan report is a list of findings with severities, and the hard part is deciding what matters. How severities are assigned, how to...

Read the guide 9 min read · Updated Sep 15, 2026 HTTP Security Headers Explained: Every Header, What It Blocks and How to Set It

Security headers are instructions a server sends the browser to switch on protections: Framing, MIME sniffing, referrer leakage, script...

Read the guide 8 min read · Updated Sep 14, 2026 Passive vs Active Scanning: What Each Can Find and When Each Is Appropriate

Passive scanning observes normal responses; active scanning sends crafted requests to trigger flaws. The boundary, why it matters...

Read the guide 9 min read · Updated Sep 12, 2026 Exposed Files: .git, .env, Backups and Debug Pages That Leak Your Site's Secrets

Many breaches start with a file that should never have been public: A .git folder, a .env with database credentials, a backup archive or...

Read the guide

Frequently asked questions

What does a deep scan add?

It crawls the site and runs the header, cookie, mixed-content, script and form checks on every page it reaches, then reports which pages failed. That matters because these things vary by path: a CDN rule that covers /en/ but not /es/, an old template still posting a form over HTTP, an archive page loading a library the rest of the site dropped. A single-page scan cannot see any of it. Pick 25, 50 or 100 pages; the report says what fraction of the site that covered.

Will the scan harm or slow down my site?

No. It makes roughly 30 ordinary GET requests over a few seconds, the same load as one visitor opening a few pages, and never submits data.

Why does my site get a lower grade than another scanner gives it?

We parse header values rather than just checking presence. A CSP that allows 'unsafe-inline' scripts, or an HSTS max-age under six months, counts as a weakness here.

Can it find SQL injection or cross-site scripting?

Not directly. Those need active testing with crafted input, which we do not do. We find the conditions that make them exploitable, such as a missing CSP or an outdated library with a known XSS.

Does it scan pages behind a login?

No. Only the URL you give and a fixed list of well-known paths are requested, unauthenticated.

How long is my report kept?

30 days, at a random unguessable link. Reports are excluded from search engines.