Free website vulnerability scanner
Find the security holes attackers look for first — expired SSL, missing headers, exposed .env and backup files, outdated WordPress, email spoofing and signs of hacking. Graded A–F in about 15 seconds, with a plain-English fix for every issue.
Free, no sign-up. The free scan is passive and safe for live sites.
What the free scan checks
Certificate expiry, issuer, chain errors, HTTP→HTTPS redirect, HSTS.
CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, cookie flags.
.env, .git/config, backups, phpinfo, directory listing — the files attackers look for first.
WordPress version and readme exposure, outdated software banners.
SPF and DMARC, so scammers can't send invoices from your domain.
Malware blocklists, Google Safe Browsing, defacement and SEO-spam cloaking that only Google sees.
Need a real vulnerability scan? Go PRO
The free scan finds misconfigurations. PRO runs an active deep scan with 5,000+ checks for known vulnerabilities: published CVEs in WordPress, plugins and CMSs, XSS, open redirects, CORS misconfiguration, subdomain takeover, exposed databases and admin panels. You also get deep re-scans up to 10 times a day and uptime checks every 5 minutes.
$8/month or $80/year by card · cancel any time · deep scans only run on domains you have verified you own.
How it works
- Enter your domain — we read it like a normal visitor would.
- Get a grade from A to F, issues sorted by risk, and copy-paste fixes for Cloudflare, nginx, Apache and WordPress.
- Verify ownership (1 minute) to turn on free weekly monitoring with email alerts, or run the PRO deep scan.
FAQ
Is the free website vulnerability scan safe for my site?
Yes. The free scan is passive: it requests your public pages and DNS records the way a normal browser does. It never logs in, submits forms or sends attack payloads, so it is safe to run on any live website.
What does the free scan check?
HTTPS redirect, TLS and certificate expiry, HSTS and other security headers, cookie flags, SPF and DMARC email spoofing protection, exposed sensitive files such as .env, .git and backups, directory listing, outdated WordPress or CMS versions, Google Safe Browsing and malware blocklists, and SEO-spam injection (cloaking).
What is the deep scan in PRO?
PRO runs an active scan with 5,000+ checks for known vulnerabilities (published CVEs in WordPress, plugins and CMSs, XSS, open redirects, CORS misconfiguration, subdomain takeover, exposed databases and admin panels). Because it actively tests your site, it is only available after you verify you own the domain.
How much does PRO cost?
$8 per month or $80 per year by card, cancel any time. The free scan and weekly monitoring with email alerts stay free.
Do I need to install anything?
No. Enter your domain and get a graded A–F report in about 15 seconds. To enable weekly monitoring or the deep scan, verify ownership with a meta tag, a DNS TXT record, a file, or one click via Cloudflare.