FreeNo sign-up, results in seconds
Free security scanner
- Headers
- SSL
- Cookies
- Exposed files
What we check
Every check the security scan runs
Passive and non-intrusive: the scan reads the public HTTP response and HTML of the URL you enter, then returns a score, the checks that passed and the findings ranked by severity.
Security scanner · 12 check groups
30+ checks for headers, cookies, CORS and exposed files. No uploads or DNS verification.
CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, CORP
HTTPS redirect, HSTS max-age & subdomains, mixed content, insecure form actions
HttpOnly, Secure, SameSite on all Set-Cookie headers
Wildcard origins, credential reflection, origin reflection attacks
TRACE (XST), PUT, DELETE on public endpoints
.env, .git, backups, wp-config, phpinfo, and common leak paths
Server version, X-Powered-By, stack traces, emails in HTML, generator meta
integrity= on third-party scripts and stylesheets
Hardcoded API keys, private keys, inline onclick handlers
CSRF tokens in POST forms, password autocomplete
target="_blank" noopener, open redirect probe, meta refresh
security.txt, robots.txt, admin URLs, error pages, tech fingerprint
Security headers and transport
The scanner reads response headers for Content-Security-Policy, X-Frame-Options, HSTS, Referrer-Policy, and related controls. It also checks whether HTTP redirects to HTTPS and whether forms or assets load over insecure schemes. Missing headers do not always mean a breach, but they are common, fixable gaps.
Cookies, CORS, and session hygiene
Set-Cookie flags such as HttpOnly, Secure, and SameSite are inspected where present. CORS configuration is checked for overly broad origins and credential reflection.
Exposed files and information leakage
Common leak paths such as .env, .git, backup archives, and debug endpoints are probed passively. Server banners, generator meta tags, and emails in HTML are flagged when they reveal more than a public site needs to.
Findings are grouped by severity. A green Passed result is not a warranty that the site is secure or fully optimized. Re-scan after you ship fixes, dependency upgrades, or infrastructure changes.
- CriticalStart here. Affects authentication, transport security, or indexability.
- HighFix in the same pass as critical items.
- MediumUsually a configuration improvement.
- LowSmall hardening or polish, worth batching into a later release.
- InfoDocuments what was observed so you can decide whether it matters for your stack.
- PassedThat check did not find a problem on this pass.
How it works
From URL to report in three steps
Scan flow
01Enter a URL
Paste the page you want to check. No account, credit card or DNS verification.
02Run the security scan
30+ passive checks run against the public response and HTML: headers, SSL, cookies, CORS, HTTP methods and common leak paths.
03Fix and re-scan
Work through findings by severity, download the report, and re-scan after you ship fixes.
Scan or audit
When a free scan is not enough
This scanner is a free, automated first pass. It is useful for triage, not a penetration test or a full manual audit.
ManualEvery finding reviewed
Full security audit by DeveloperLook
- Authenticated tests
- Threat modeling
- Fixes shipped
The scan checks
- Security headers, SSL and HSTS
- Cookie flags and CORS policy
- Exposed files and information leakage
- A score, ranked findings and a downloadable report
The scan does not
- Logging in or authenticated tests
- Exploiting vulnerabilities or a penetration test
- Business logic, privilege escalation or API fuzzing
- A crawl of every page
The audit adds
- Authenticated testing
- Threat modeling
- Manual review of every finding
- Remediation planning
- Production hardening, shipped by our team
Related servicesWebsite security auditPenetration testing
More free tools
Three more free tools
Same rules: free, no sign-up, and a result you can act on.
Project investment calculator
Free · no sign-upPick a project type, a size and the features you need, and get a cost, timeline and team estimate before your first call.
Website speed test
Free · no sign-upSee how fast your page answers and loads, and what slows it down: compression, caching, scripts, images and third parties.
SEO checker
Free · no sign-upCheck one page for the on-page basics search engines read first: titles, meta tags, headings, alt text and indexability.
FAQ
Questions about the security scanner
Saimul IslamFounder & CEO, DeveloperLookStill have questions?
Send a message or book a call with the team.
Yes. It is free to use with no account, credit card or sign-up, and you can run as many scans as you need.
More than 30 checks in 12 groups: HTTP security headers such as Content-Security-Policy and X-Frame-Options, SSL and HSTS, cookie flags, CORS, HTTP methods, sensitive files such as .env and .git, information leakage, subresource integrity, secrets in the page source, forms and sessions, links and redirects, and security.txt and robots.txt.
Yes. The checks are passive: they read the public response and HTML the way a browser does, plus a few requests for common leak paths. Nothing on your site changes.
Only scan sites you own or have permission to test. Scanning a third-party site without permission can break its terms of service and local law.
Results are generated for your browser session and are not published as public pages. Download the report if you want to keep a copy.
The scanner reports what the public response and HTML of one URL show. That makes it reliable for triage, but it is not a penetration test: treat each finding as a lead to verify.
The scanner is a free, automated first pass. A full audit adds authenticated testing, threat modeling, a manual review of every finding and a remediation plan, and our team can ship the fixes.
After major releases, dependency upgrades or hosting changes, and at least monthly for production sites. Fix critical and high findings before the next release.
Saimul IslamFounder & CEO, DeveloperLookStill have questions?
Send a message or book a call with the team.
30-min strategy callGoogle Meet
Book a call
Book Your Exclusive Strategy Session Today!
Pick a 30-minute slot that works for you. We meet on Google Meet to align on goals, scope, and the right next step.
