Find website vulnerabilities
before attackers do.

Seven areas, each scored out of 100: active vulnerability testing (SQL injection, cross-site scripting and more), security headers and SSL/TLS, the technology your site is built with, malware and blacklist reputation, technical SEO, on-page SEO, and page speed on phones and computers.

No account and no signup, just paste a URL and scan. Scanning is free within fair rate limits that keep the service fast for everyone.

The standard scan usually takes about a minute: fast template-based vulnerability checks (the Nuclei engine) plus all the passive checks. The optional deep scan takes 5–10 minutes because it crawls and probes your site the way attackers do (the Wapiti engine). Keep the tab open while it runs.

Yes for sites you own. Deep scan sends harmless test requests to your site's forms and URLs never destructive payloads. Only scan websites you own or have written permission to test.

Yes. Every finished scan gets a link you can send to anyone. Use the "Copy share link" button on the report page, or download a branded PDF.

We keep the report so your share link keeps working, and we log your IP address briefly for rate limiting and abuse prevention. We use Google Analytics for aggregate usage measurement, but don't use advertising cookies or sell your information. Full details in our Privacy Policy.

That's the design goal. Each section starts with a plain-language "What this means", every finding uses a friendly label (Fix now, Fix soon, Worth fixing…), and technical details stay tucked inside expandable boxes.

No, and no automated scanner can give that guarantee. Our report finds common, known issues, but it can't catch everything. Read the Disclaimer for the full picture, and get a professional security review for anything critical.

Warning signs include redirects to spam sites, "Deceptive site ahead" browser warnings, unknown admin accounts, spam pages appearing in Google, or a sudden traffic drop. The fastest check is a scan: our website malware scanner inspects your pages and checks blocklist reputation across threat-intelligence sources. Read the full guide.

Yes. Paste your WordPress site's URL into the scanner, nothing to install, no signup. The scan checks for exposed files, security headers, outdated detectable software and other common WordPress weaknesses from the outside. Learn more.

Security headers are instructions your server sends browsers, they block clickjacking, force HTTPS, and limit what scripts can run. Missing headers are one of the most common findings on otherwise healthy sites. Our security headers check grades yours and tells you exactly what's missing. Learn more.

A vulnerability scan is automated: it checks your site against known flaws and misconfigurations in minutes. A penetration test is a human expert actively trying to break in, deeper, slower and far more expensive. For most sites, regular free scans plus a professional pentest before big launches is the sensible combination. Comparison guide.

At least monthly, plus after every plugin/theme update, redesign or migration. New vulnerabilities are disclosed constantly, and a site that was clean last month may not be today. Rescanning is free, so make it a habit.

Scanning a website you own or have written permission to test is fine, that's exactly what this tool is for, and we ask you to confirm permission before every scan. Never scan sites you don't own or aren't authorized to test; unauthorized probing can be illegal.

Don't panic and don't delete things blindly. Back up the site first (including the infected files, as evidence), remove the malicious code, then fix the entry point, usually an outdated plugin or weak login. If Google flagged your site, request a review in Search Console after cleanup. Malware cleanup guide.

Yes. Google flags hacked sites with warnings that destroy click-through, HTTPS is a confirmed ranking signal, and a hacked or painfully slow site bleeds rankings fast. Security and SEO aren't separate jobs that's why our report covers both in one scan.