Free Site Security Scanner

SecScanner runs 62 automated, non-intrusive checks across four categories: TLS/SSL (certificate expiry, cipher suites, TLS version), security headers (CSP, HSTS, X-Frame-Options, CORS, Permissions-Policy), content vulnerabilities (outdated JS libraries, sensitive file exposure, admin panels, source maps), and DNS security (SPF, DKIM, DMARC, CAA, DNSSEC).

Yes — 24 checks are free for every scan with no account required. Create a free account to get the full 62-check report and scan history. Upgrade to Pro for continuous monitoring with automatic alerts when your security posture changes.

Most scans complete in under 60 seconds. The scanner runs all checks in parallel, so TLS handshakes, header analysis, DNS queries, and content scanning happen simultaneously rather than sequentially.

Yes — all checks are non-intrusive and passive. We analyze publicly visible responses and DNS records without attempting to exploit anything or send unusual traffic. We do not test for SQL injection, XSS, or other active attack techniques — the scanner complements rather than replaces a penetration test.

Mozilla Observatory focuses on security headers and TLS. SecScanner covers those plus DNS security (SPF/DKIM/DMARC/DNSSEC), content vulnerabilities (outdated JavaScript libraries, exposed admin panels, sensitive files, source maps), and PII disclosure — giving you a broader security picture in a single scan.

You can scan any publicly accessible website — all checks are non-intrusive reads of public data. This is useful for competitive security analysis or verifying third-party vendor security posture.

Each scan produces a security score from 0–100 based on the number of passed checks, weighted by severity (critical, high, medium, low). Critical issues like expired certificates or missing CSP have the largest impact. The score lets you track improvement over time and compare against baselines.