The best free website security scanners, compared

This is the tool on this site. The quick check grades your HTTPS redirect, HSTS, CSP, frame protection, nosniff, Referrer Policy and cookie flags from A to F, free and with no signup. The full check, run on your own site after you add a tag, looks for secret keys in your HTML and scripts, public .env and .git files, loose CORS, version banners and Supabase or Firebase config. Every finding links to a fix with a prompt for your AI agent. It reads pages with GET and HEAD requests only, so it doesn't send attack payloads, check for malware or test TLS in depth.

SiteCheck looks for known malware, defacements, spam, blocklisting with authorities such as Google and PhishTank, outdated CMS software and vulnerable plugins, plus hardening tips such as a missing CSP or HSTS. Sucuri notes that a remote scanner only sees what's visible at the browser level. The scan is free; the paid platform with server side scanning and cleanups starts at $229 a year.

The Observatory scores your headers from a baseline of 100 up to 145 and grades them A+ to F. Its tests cover CSP, HSTS, cookies, CORS, redirection, Referrer Policy, Subresource Integrity and the cross origin policies. It's open source, runs locally with npx and has a free API. Its FAQ says it doesn't test TLS, outdated software or SQL injection, and that each domain's scan history is public.

A simple, free tool from Snyk that grades your response headers from A+ to F and lists which are present or missing, along with informational headers like Server and X-Powered-By. Its API page says the API service has been discontinued.

The SSL Server Test checks that your certificate is valid and trusted and grades your protocol, key exchange and cipher support, with tests for known TLS flaws such as Heartbleed and POODLE. Its rating guide says it doesn't attempt to detect web application problems. The web test is free; the API needs registration with an organization email.

ImmuniWeb's Website Security Test covers HTTP security headers, cookie flags, CMS and JavaScript library versions with known vulnerabilities, WAF detection, DNSSEC, Subresource Integrity, and GDPR and PCI DSS checks. You get 10 tests a month without an account and 20 with a free one. Premium plans, with full report details and PDF export, start at 25 EUR a month.

UpGuard's free instant score rates a domain from 0 to 950 with a letter grade across risk factors such as email security, SSL, DNS health and common vulnerabilities. Its sample report includes header checks, DMARC and SPF, open ports, TLS versions and reputation lists. The paid vendor risk platform starts at $1,750 a month, billed annually.

Its Website Vulnerability Scanner has a passive Light scan that checks headers, cookies, CORS, server software and more, usually in under 2 minutes, and a Deep scan that sends test payloads for SQL injection, XSS, command injection and many more issues. Its FAQ offers 2 free scans a day, and the free edition includes limited deep scanning. Paid plans start from $95 a month and vary with the number of assets.

HostedScan runs ZAP, OpenVAS, Nuclei, SSLyze and Nmap for you from a dashboard. Its passive scan is non intrusive; its active scan submits forms to test for SQL injection, XSS and more, and can take several hours. A free scan emails you a report, new accounts get a 14 day trial of the Premium plan, and plans start at $39 a month, billed annually.

ZAP is a free, open source scanner you install and run on the desktop, in Docker or in CI. Its docs call passive scanning safe, and warn that active scanning is a real attack that may create, modify or delete data, so point it at a staging copy. Its rules cover injection bugs, CORS, .env and .git exposure, several key patterns and Firebase config, some of them still in beta.

• Built your app with Lovable, Bolt, v0, Cursor or Claude Code: PwnMyVibeCode and an SSL Labs test.
• Running WordPress or another CMS: Sucuri SiteCheck and ImmuniWeb.
• Only care about headers: the MDN HTTP Observatory or SecurityHeaders.com.
• Need injection testing: ZAP or Pentest-Tools.com, against a staging copy.

No outside scanner sees your server code, your login logic or your database rules from the inside. Pair any of these with a look at your own access rules and an eye on advisories for the packages you use.