FREE PASSIVE SECURITY SCAN

Scan Your Website Security

Discover common security misconfigurations and publicly exposed resources — missing headers, weak SSL, exposed backups, and more — in under a minute.

Only scan sites you own or are authorized to test.

What We Check

10 passive, non-destructive check categories run against every scan.

HTTPS & Redirects

Confirms HTTPS is available and plain HTTP properly redirects.

Security Headers

CSP, HSTS, X-Frame-Options, and more, with pass/warn/missing status.

SSL/TLS Configuration

Certificate validity, expiration, and hostname matching.

Cookie Security

Secure, HttpOnly, and SameSite flags on every cookie.

CORS Configuration

Flags overly permissive cross-origin resource sharing.

Exposed Files

Checks for publicly accessible .env, backups, and config files.

Directory Listing

Detects browsable directory indexes on common paths.

JavaScript Exposure

Source maps, debug code, and leaked-secret patterns (redacted).

Technology Detection

Passively identifies your stack — server, CMS, frameworks.

Risk Scoring

A single 0–100 score with severity-weighted findings.

How It Works

1
Enter a URL

Paste the site you want to check — no signup required for a preview.

2
We scan passively

Read-only HTTP requests only. Nothing is modified, deleted, or exploited.

3
Get a scored report

A 0–100 security score with clear, prioritized recommendations.

Example Report

Target
example.com
92
Grade A · Excellent
0
Critical
0
High
2
Medium
3
Low
8
Info

Pricing

Free
$0
  • 10 scans / hour
  • Full check suite
  • On-screen results
Get Started
Pro
Contact us
  • Everything in Free
  • PDF / CSV / JSON exports
  • Scan history & scheduling
Get Started

Frequently Asked Questions

No. WebGuard Scanner performs passive, non-destructive checks only — it never attempts exploitation, brute force, or login attempts.

Yes. Only scan websites you own or are explicitly authorized to test.

Scans are rate-limited, timeout-limited, and read-only. They do not modify or delete anything on the target.

We never display file contents. Only the URL, HTTP status, content type, and size are reported.
Disclaimer: WebGuard Scanner is provided for legitimate security assessment of websites you own or are authorized to test. Unauthorized scanning of third-party systems may violate computer misuse laws in your jurisdiction. Use responsibly.