Free Website Scanner for
Security, Speed, and SEO
Instant security report: 30+ checks for headers, cookies, CORS, exposed files, and more. No file uploads or DNS verification.
Free, no signup required. Only scan sites you own or have permission to test.
Passive security checks
Each check reports as Passed or an issue with severity. No exploits, uploads, or login required.
HTTP Security Headers
CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, CORP
SSL / HTTPS
HTTPS redirect, HSTS max-age & subdomains, mixed content, insecure form actions
Cookie Security
HttpOnly, Secure, SameSite on all Set-Cookie headers
CORS
Wildcard origins, credential reflection, origin reflection attacks
HTTP Methods
TRACE (XST), PUT, DELETE on public endpoints
Sensitive Files
.env, .git, backups, wp-config, phpinfo, and common leak paths
Information Leakage
Server version, X-Powered-By, stack traces, emails in HTML, generator meta
Subresource Integrity
integrity= on third-party scripts and stylesheets
Page Source
Hardcoded API keys, private keys, inline onclick handlers
Forms & Session
CSRF tokens in POST forms, password autocomplete
Links & Redirects
target="_blank" noopener, open redirect probe, meta refresh
Policies & Discovery
security.txt, robots.txt, admin URLs, error pages, tech fingerprint
What this scanner checks
DeveloperLook's free website scanner runs three related audits from one URL: security, speed, and SEO. Each mode is passive and non-intrusive. It inspects the public HTTP response and HTML of the URL you provide, then returns a score, passed checks, and prioritized findings.
Security headers and transport
The scanner reads response headers for Content-Security-Policy, X-Frame-Options, HSTS, Referrer-Policy, and related controls. It also checks whether HTTP redirects to HTTPS and whether forms or assets load over insecure schemes. Missing headers do not always mean a breach, but they are common, fixable gaps that raise the cost of common attacks.
Cookies, CORS, and session hygiene
Set-Cookie flags such as HttpOnly, Secure, and SameSite are inspected where present. CORS configuration is checked for overly broad origins and credential reflection. These findings help you catch accidental exposure of session cookies or cross-origin APIs before they become incidents.
Exposed files and information leakage
Common leak paths such as .env, .git, backup archives, and debug endpoints are probed passively. Server banners, generator meta tags, and emails in HTML are flagged when they reveal more than a public site needs to. Treat these as triage signals, then confirm and remediate in your own environment.
Speed and delivery signals
The speed scan measures server-side timing and delivery cues such as TTFB, compression, caching headers, and render-blocking assets. It is not a lab Lighthouse run and does not produce Core Web Vitals from a real browser. Use it to spot obvious delivery problems before a deeper performance engagement.
On-page SEO and indexability
The SEO scan reviews titles, meta descriptions, heading structure, image alt text, Open Graph tags, and robots or noindex directives on the requested URL. It does not crawl your whole site or pull Search Console data. It is a fast first pass on the page you paste in.
How to read your results
Findings are grouped by severity. Start with critical and high items that affect authentication, transport security, or indexability. Medium items are usually configuration improvements. Informational items document what was observed so you can decide whether it matters for your stack.
A green Passed result means that check did not find a problem on this pass. It is not a warranty that the site is secure or fully optimized. Re-scan after you ship fixes, dependency upgrades, or infrastructure changes.
What this tool does not check
This scanner does not log in, does not run authenticated tests, does not exploit vulnerabilities, and does not replace a penetration test. It will not cover business logic flaws, privilege escalation, or deep API fuzzing. Speed results are edge probes, not browser lab scores. SEO results cover one URL, not a full crawl or rankings.
Only scan sites you own or have explicit permission to test. Unauthorized scanning of third-party sites can violate terms of service and local law.
How it works
Enter a URL, choose a scan type, and run the check. Results are generated for your browser session and are not published as public pages. No account or credit card is required. We designed the tool as a free triage aid, not a permanent archive of other people's sites.
When you need a full audit
If you need authenticated testing, remediation planning, or a production hardening engagement, talk to the DeveloperLook team. Start from the contact page or review our development services.
FAQFAQ
Frequently Asked Questions
Is the website scanner really free?
Yes. The DeveloperLook website scanner is free to use with no account, credit card, or signup. You can run security, speed, and SEO checks from a single URL at any time.
Do I need to create an account?
No. Enter a URL, choose security, speed, or SEO, and run the scan. Results appear in the browser. We do not require login to use the tool.
What does the scanner check?
It covers HTTP security headers, SSL and TLS, cookie flags, CORS, common exposed files, server response and load timing signals, titles, meta tags, headings, alt text, Open Graph tags, and indexability directives.
Do you store the results of my scan?
Scan results are generated for your browser session and are not published as public pages. Do not treat this as a permanent archive. Only scan sites you own or have permission to test.
Can I scan a website I do not own?
You should only scan sites you own or have explicit permission to test. Unauthorized scanning of third-party sites can violate terms of service and local law.
How accurate are the results?
The tool runs passive, non-intrusive checks against the public HTML and HTTP responses of a URL. It is useful for triage, not a penetration test or full lab Lighthouse audit. Treat findings as leads to verify.
What is the difference between this and a full security audit?
This scanner is a free, automated first pass. A full audit includes authenticated testing, threat modeling, remediation planning, and manual review. Contact DeveloperLook if you need that deeper engagement.
How often should I scan my website?
Scan after major releases, dependency upgrades, or infrastructure changes, and at least monthly for production sites. Critical findings should be fixed before the next release cycle.