Web Scanner · Free · No account required

Know before your users do.

Paste a URL and get a complete security report in seconds. TLS health, missing headers, cookie flags, CORS policy, and exposed API keys. Free, no sign-up.

No account requiredRead-only scanNo source code required

Only scan sites you own or are authorized to test. Reports are stored and accessible via link — see how we handle scan data on the Trust page.

How it works

Results in under five seconds.

Enter any URL

Paste your website, staging environment, or API endpoint. No account or sign-up required.

Scanner runs immediately

We fetch the URL, follow redirects, and run every check in parallel — typically under five seconds.

Get a prioritized report

Findings ranked Critical → Low with a launch score and specific remediation steps for your stack.

Coverage

What we check

TLS / HTTPS

Certificate validity, expiry date, and protocol version

Security headers

CSP, HSTS, X-Frame-Options, Referrer-Policy

Cookie flags

Secure, HttpOnly, and SameSite attributes on every response cookie

CORS policy

Overly permissive cross-origin resource sharing, including wildcard + credentials

AI key detection

Exposed OpenAI, Anthropic, and other LLM API keys in HTTP responses

Open cloud endpoints

Public Supabase, Firebase, and S3 buckets accessible without authentication

Redirect analysis

HTTP-to-HTTPS redirects, redirect loops, and final destination tracking

SSRF-safe scanning

We never connect to private or internal addresses

Privacy: We only fetch publicly accessible URLs. Your scan is processed in our cloud worker and results are stored briefly for sharing. We never store your report longer than necessary and we never sell data. See our privacy policy.