Enter the address
Type a domain such as example.com or a full URL. Private and internal addresses are refused.
Scan a Website for Vulnerabilities
Enter a domain or URL. Scan.now fetches the page like a browser, opens TLS connections, looks up DNS and requests a fixed list of well-known paths. Sixty passive checks, graded A+ to F, each linked to an explanation and a fix.
Public hosts only. About 30 requests, usually finished in under 15 seconds. How we scan · Acceptable use
Scanning…
First results
The full scan is still running
How it works
We run 60 passive checks
Transport security, headers, cookies, page content, exposed files and DNS, in parallel, usually in under 15 seconds. Switch to a deep scan and the page-level checks run on every page we crawl, not only the one you entered.
Read the graded report
Findings are sorted by severity with evidence and a link to the fix. Share the report by link for 30 days.
What this tool checks
61 checks across 6 areas. Each links to its reference page with the test, the risk and the fix.
Page content and JavaScript
10 checksCookie security
4 checksDNS and email authentication
8 checksExposed files and information disclosure
14 checksHTTP security headers
13 checksTransport security (HTTPS / TLS)
12 checksThe ones that most often decide the grade:
Critical
HTTPS is availableThe site could not be reached over HTTPS on port 443, or the TLS handshake failed. Everything it serves travels in...
High
HTTP redirects to HTTPSPort 80 serves page content instead of redirecting to HTTPS, or the redirect chain is wrong. Visitors who type the...
High
Deprecated TLS versions accepted (1.0 / 1.1)The server still completes handshakes with TLS 1.0 or TLS 1.1. Both were formally deprecated by RFC 8996 in 2021 and...
Critical
Certificate chain and hostname validationThe certificate presented for this hostname did not validate: The chain does not reach a trusted root, an...
High
Certificate expiryThe certificate has expired or will expire within 30 days. Once it lapses every browser, API client and mail gateway...
High
CORS allows arbitrary origins with credentialsThe server reflects any Origin in Access-Control-Allow-Origin while also sending Access-Control-Allow-Credentials:...
Medium
Strict-Transport-Security (HSTS)The HTTPS response carries no Strict-Transport-Security header, or its max-age is too short to protect returning...
Info
HSTS preload eligibilityThe domain does not yet meet the requirements for the browser HSTS preload list. Preloading is optional, so this is...
Low
TLS 1.3 supportThe server negotiates TLS 1.2 at best and does not offer TLS 1.3. This is not a vulnerability on its own, but it...
Medium
Certificate key strengthThe certificate's public key is weaker than current guidance: An RSA key shorter than 2048 bits, or a DSA key. Such...
Medium
Certificate signature algorithmA certificate in the chain is signed with SHA-1, MD5 or another broken hash. Browsers reject SHA-1-signed...
Medium
Weak cipher suites acceptedThe server is willing to negotiate legacy cipher suites such as RC4, 3DES, export-grade, NULL or anonymous suites,...
Info
HTTP/2 supportThe server negotiates only HTTP/1.1 over TLS and does not advertise HTTP/2. This is a performance and modernity...
Medium
Content-Security-Policy missingThe page is served without an enforced Content-Security-Policy. If an attacker finds any way to inject markup, the...
Medium
Content-Security-Policy is weakA Content-Security-Policy exists but contains directives that let injected script run anyway: 'unsafe-inline'...
Medium
Clickjacking protection (X-Frame-Options / frame-ancestors)The page can be embedded in a frame on any other site. An attacker can overlay your buttons with invisible decoys...
Low
X-Content-Type-Options: nosniffResponses lack X-Content-Type-Options: Nosniff, so browsers may guess a content type and execute a file as script or...
Low
Referrer-PolicyNo Referrer-Policy is set, or it is set to a value that sends full URLs to other sites. Paths and query strings,...
Low
Permissions-PolicyNo Permissions-Policy header restricts powerful browser features. Any script on the page, including third-party...
Low
Cross-Origin-Opener-PolicyThe page does not set Cross-Origin-Opener-Policy, so windows it opens, or that open it, from other origins keep a...
Info
Cross-Origin-Resource-PolicyResponses do not carry Cross-Origin-Resource-Policy, so other origins may embed them as scripts, images or fetches...
Info
X-XSS-Protection (deprecated header)The response sets X-XSS-Protection to 1 or 1; mode=block. No current browser implements the filter it controls, and...
Low
Server version disclosureThe Server header reveals the exact web server software and version, such as Apache/2.4.58 (Ubuntu) or nginx/1.24.0,...
Low
X-Powered-By technology disclosureAn X-Powered-By or similar header announces the application platform and often its version (PHP/8.1.2, ASP.NET,...
Info
Cache-Control on pages that set cookiesA response that sets cookies, and is therefore personalised, does not tell caches to keep out. A shared cache could...
Medium
Cookie without Secure flagA cookie is set without the Secure attribute, so the browser will also send it over plain HTTP. An attacker who can...
Medium
Cookie without HttpOnly flagA cookie is readable by JavaScript because it lacks the HttpOnly attribute. Any script injected into the page, or...
Low
Cookie without SameSite attributeA cookie is set without a SameSite attribute, or with SameSite=None but no Secure flag. Depending on the browser, it...
Info
Cookie name prefixes (__Host- / __Secure-)Session cookies do not use the __Host- or __Secure- name prefixes, so a subdomain, an HTTP origin or a lookalike...
High
Mixed content (HTTP resources on an HTTPS page)The HTTPS page loads scripts, styles, frames or media over plain HTTP. Active mixed content is blocked by browsers...
High
Form submits over HTTPA form on the page submits to a plain-HTTP URL. Whatever the user types, including passwords and card numbers,...
Low
Third-party scripts without Subresource IntegrityScripts or stylesheets are loaded from third-party hosts without an integrity attribute. If that host is compromised...
High
JavaScript library with known vulnerabilitiesThe page loads a JavaScript library version with published vulnerabilities. Whether it is exploitable depends on how...
Low
CMS / generator version disclosureThe page announces the CMS or static-site generator it was built with, usually including the version, in a meta tag,...
Info
Third-party script inventoryAn inventory of every script the page loads from other domains. This is informational, but each host on the list...
Low
Advertising and tracking endpointsWhich of the page's third-party hosts exist to advertise to the visitor or to follow them, matched against the...
Info
Inline event handlers and scriptsThe page relies on inline scripts, on* event-handler attributes or javascript: URLs. These are not vulnerabilities...
Low
Sensitive information in HTML commentsHTML comments in the page source contain material that looks internal: Credentials, TODO notes, internal hostnames...
Info
Password field autocompletePassword fields on the page either try to disable autocomplete, which browsers ignore and password managers dislike,...
Critical
Exposed .git repositoryThe site's .git directory is reachable over HTTP. Anyone can reconstruct the full source repository, including...
Critical
Exposed .env configuration fileA .env configuration file is served from the web root. These files hold database passwords, API keys, mail...
High
Exposed backup or archive filesA backup archive, database dump or editor backup copy of a configuration file is downloadable from the web root,...
High
Exposed phpinfo() pageA phpinfo() page is publicly reachable. It prints the PHP version, every loaded module, configuration paths, and...
Medium
Directory listing enabledThe web server generates an index of files for a directory that has no index page, exposing every file in it,...
Medium
Exposed server status pageA server status page (Apache mod_status, nginx stub_status or PHP-FPM status) is reachable from the internet,...
Low
Exposed .DS_Store fileA macOS .DS_Store file is served from the web root. It lists the names of files and folders in that directory,...
Info
robots.txt reviewA review of robots.txt. The file is public and advisory, so Disallow lines that name private or administrative paths...
Info
security.txt (RFC 9116) presentNo security.txt file was found at /.well-known/security.txt, or the one present is invalid or expired. Researchers...
Low
WordPress version disclosureThe site runs WordPress and reveals its exact core version through the generator tag, asset query strings,...
Medium
WordPress xmlrpc.php enabledThe WordPress XML-RPC endpoint at /xmlrpc.php is enabled. It allows hundreds of login attempts per request through...
Medium
WordPress user enumeration via REST APIThe WordPress REST API or author archives reveal account usernames to anonymous visitors, giving attackers half of...
Low
HTTP TRACE method enabledThe server answers HTTP TRACE requests by echoing them back. The method has no legitimate use on a production site...
Info
Redirect parameters on the pageLinks or forms on the page carry parameters whose names and values suggest a redirect target (next=, return_to=,...
Medium
SPF recordThe domain publishes no valid SPF record, or publishes more than one, so receiving mail servers cannot tell which...
High
SPF record is too permissiveThe SPF record ends in +all or ?all, omits the all mechanism, or authorises very large address ranges, so a forged...
Medium
DMARC recordNo DMARC record is published at _dmarc.<domain>, or the record is malformed. Receivers have no instruction on what...
Low
DMARC policy is p=none (monitoring only)The DMARC record exists but uses p=none, so receivers are asked to deliver spoofed mail normally. Monitoring is the...
Info
DKIM selector discoveredNo DKIM public key was found under the common selector names, or the key found is weak or revoked. Without DKIM,...
Info
MX recordsA review of the domain's MX records: Whether mail is deliverable, whether every mail host resolves, and whether a...
Low
DNSSEC signingThe domain's DNS zone is not signed with DNSSEC, so a resolver cannot verify that the answers it receives for your...
Low
CAA recordNo CAA record limits which certificate authorities may issue certificates for the domain, so any of the hundred-plus...
What a website vulnerability scan covers
One scan combines transport, browser-policy, content, public-exposure and DNS checks without attempting to exploit the site.
A public website is protected by several layers that can fail independently. HTTPS may be valid while cookies are missing security flags, a strong Content-Security-Policy may coexist with an exposed backup file, or the main page may be clean while an older section still loads a vulnerable library. The website scanner brings these signals into one graded report.
The quick scan examines the exact page entered plus fixed public endpoints, TLS handshakes and DNS records. A deep scan follows internal links and sitemap URLs up to the selected budget, then repeats page-level checks across the sample. The report separates confirmed observations from recommendations and gives every failing check an explanation and practical fix.
Public addressNormalise the URL and refuse private network targets.
Five security layersInspect HTTPS, headers, cookies, content, exposure paths and DNS.
Prioritised reportSort findings by severity and show evidence plus remediation.
Put this result in context
This scanner answers one part of the review. Continue with LLM API Key Scanner for openai, anthropic, gemini and other ai keys, then SSL / TLS Checker for certificate, expiry, protocols, ciphers. These are separate checks because a strong result here does not prove that the adjacent surface is healthy.
For the background behind these signals, read Website Security: What a Vulnerability Scan Looks For and How to Fix It and What Is a Vulnerability Scan? Types, Limits and What the Results Mean. The HTTPS is available check reference explains the exact test, evidence and remediation used in the report. The Scan.now methodology explains request limits, scan boundaries and what the scanner deliberately does not attempt.
Website security scan coverage at a glance
The grade combines different controls. A failure in one row does not imply every other layer is weak.
| Area | What is examined | Why it matters |
|---|---|---|
| TLS and certificates | Certificate trust, hostname, expiry, protocols, key strength and weak cipher families. | Protects the connection from interception and downgrade. |
| HTTP security headers | CSP, HSTS, framing, MIME sniffing, referrer, permissions and cross-origin policies. | Constrains what a browser may load, reveal or embed. |
| Cookies and page content | Cookie flags, mixed content, insecure forms, public scripts and risky page signals. | Finds browser-visible weaknesses that vary by route or template. |
| Public exposure paths | A fixed list of environment, Git, backup, configuration and diagnostic locations, verified by content. | Catches files that should never have reached the public server. |
| DNS and email posture | SPF, DMARC, MX, DNSSEC and CAA signals associated with the domain. | Shows spoofing and infrastructure controls outside the HTML page. |
How to read the website scan grade
Use the letter grade as a summary, then make decisions from the individual evidence.
Strong baseline
The scanned surface passed the important controls available to this passive review. Keep monitoring because certificates, dependencies and deployment files change.
High-priority failure
A confirmed exposure, obsolete transport setting or major browser-policy gap should be reviewed first. The report identifies the exact check and observed evidence.
Coverage matters
A quick scan describes one page and fixed endpoints. Use a deep crawl when templates, languages, subdirectories or legacy sections may behave differently.
Use the report in the right order
- Fix critical and high-severity findings before cosmetic score improvements.
- Apply the change at the shared server, CDN or application-template layer when many pages are affected.
- Retest the exact failing URL and confirm that the evidence changed, not only the displayed grade.
- Run a deeper crawl after major releases so old routes and alternate templates are included.
What this result does not prove
- The passive scanner does not submit forms, log in, exploit vulnerabilities or inspect private source code.
- A clean quick scan does not prove that every page, hostname, API endpoint or authenticated workflow is clean.
- CDNs, security products and geographic routing can return a different configuration to other visitors.
Related tools
Continue the review with four checks that cover adjacent parts of the same attack surface.
LLM API Key Exposure Scanner
OpenAI, Anthropic, Gemini and other AI keys
SSL / TLS Checker
Certificate, expiry, protocols, ciphers
Security Headers Checker
CSP, HSTS, frame and MIME policies
Email Security Checker (SPF, DKIM, DMARC)
SPF, DKIM, DMARC and MX records
Guides for this tool
Background reading written to go with these results.
13 min read · Updated Sep 13, 2026
Website Security: What a Vulnerability Scan Looks For and How to Fix It
A website vulnerability scan checks the parts of a site an attacker can reach without logging in: Transport security, HTTP headers,...
Read the guide
8 min read · Updated Sep 12, 2026
What Is a Vulnerability Scan? Types, Limits and What the Results Mean
A vulnerability scan checks a system against a list of known weaknesses and reports what matches. The types of scan, the difference...
Read the guide
9 min read · Updated Sep 18, 2026
How to Read a Security Scan Report: Severity, False Positives and What to Fix First
A scan report is a list of findings with severities, and the hard part is deciding what matters. How severities are assigned, how to...
Read the guide
9 min read · Updated Sep 15, 2026
HTTP Security Headers Explained: Every Header, What It Blocks and How to Set It
Security headers are instructions a server sends the browser to switch on protections: Framing, MIME sniffing, referrer leakage, script...
Read the guide
8 min read · Updated Sep 14, 2026
Passive vs Active Scanning: What Each Can Find and When Each Is Appropriate
Passive scanning observes normal responses; active scanning sends crafted requests to trigger flaws. The boundary, why it matters...
Read the guide
9 min read · Updated Sep 12, 2026
Exposed Files: .git, .env, Backups and Debug Pages That Leak Your Site's Secrets
Many breaches start with a file that should never have been public: A .git folder, a .env with database credentials, a backup archive or...
Read the guideFrequently asked questions
What does a deep scan add?
It crawls the site and runs the header, cookie, mixed-content, script and form checks on every page it reaches, then reports which pages failed. That matters because these things vary by path: a CDN rule that covers /en/ but not /es/, an old template still posting a form over HTTP, an archive page loading a library the rest of the site dropped. A single-page scan cannot see any of it. Pick 25, 50 or 100 pages; the report says what fraction of the site that covered.
Will the scan harm or slow down my site?
No. It makes roughly 30 ordinary GET requests over a few seconds, the same load as one visitor opening a few pages, and never submits data.
Why does my site get a lower grade than another scanner gives it?
We parse header values rather than just checking presence. A CSP that allows 'unsafe-inline' scripts, or an HSTS max-age under six months, counts as a weakness here.
Can it find SQL injection or cross-site scripting?
This passive scanner does not send attack probes. Use the separate owner-authorised XSS Scanner and SQL Injection Scanner for bounded active tests against public GET parameters.
Does it scan pages behind a login?
No. Only the URL you give and a fixed list of well-known paths are requested, unauthenticated.
How long is my report kept?
30 days, at a random unguessable link. Reports are excluded from search engines.
