Web Scanner · Free · No account required
Know before your users do.
Paste a URL and get a complete security report in seconds. TLS health, missing headers, cookie flags, CORS policy, and exposed API keys. Free, no sign-up.
How it works
Results in under five seconds.
01
Enter any URL
Paste your website, staging environment, or API endpoint. No account or sign-up required.
02
Scanner runs immediately
We fetch the URL, follow redirects, and run every check in parallel — typically under five seconds.
03
Get a prioritized report
Findings ranked Critical → Low with a launch score and specific remediation steps for your stack.
Coverage
What we check
TLS / HTTPS
Certificate validity, expiry date, and protocol version
Security headers
CSP, HSTS, X-Frame-Options, Referrer-Policy
Cookie flags
Secure, HttpOnly, and SameSite attributes on every response cookie
CORS policy
Overly permissive cross-origin resource sharing, including wildcard + credentials
AI key detection
Exposed OpenAI, Anthropic, and other LLM API keys in HTTP responses
Open cloud endpoints
Public Supabase, Firebase, and S3 buckets accessible without authentication
Redirect analysis
HTTP-to-HTTPS redirects, redirect loops, and final destination tracking
SSRF-safe scanning
We never connect to private or internal addresses
Privacy: We only fetch publicly accessible URLs. Your scan is processed in our cloud worker and results are stored briefly for sharing. We never store your report longer than necessary and we never sell data. See our privacy policy.