How It Works

Three steps from URL to a report you can actually understand, and a look under the hood at the seven checks behind every scan.

The three steps

• 1. Enter a URL & confirm permission. Paste the website address and confirm you own it or have written permission to test it. No account, no signup.
• 2. We run the checks. The standard scan fires thousands of template-based vulnerability checks plus all passive checks, usually done in about a minute. The optional deep scan adds crawl-based probing and takes 5–10 minutes.
• 3. Get a plain-language report. A clear grade per section, prioritized fixes explained simply, a shareable link, and a branded PDF you can send to anyone.

The seven checks

• Vulnerabilities. Active testing for known flaw classes, SQL injection, cross-site scripting (XSS), misconfigurations, exposed admin panels and thousands of CVE-based checks. The fast default uses template matching; deep mode crawls and probes like an attacker would.
• Security headers. Grades the protective headers your server sends (HSTS, Content-Security-Policy, X-Frame-Options and more), validates your SSL/TLS certificate, and checks cookie flags.
• Malware & reputation. Checks your pages for injected scripts and suspicious code, and checks whether your domain appears on security blocklists that trigger browser warnings.
• Technology. Identifies your CMS, server software and JavaScript libraries from public signals, including outdated versions with known issues.
• Technical SEO. The foundations search engines need: HTTPS, redirects, robots.txt, XML sitemap, canonical tags and indexability.
• On-page SEO. Titles, meta descriptions, heading structure, images and schema markup on your key pages.
• Page speed. Core Web Vitals (LCP, CLS, INP) for mobile and desktop, with plain-language fixes.

How scoring works

Each section that completes gets a score from 0–100 and a grade (A–F). The overall score is the average of completed sections. A section that ran clean scores an honest 100, that's a measured result, not an assumption. Vulnerabilities and speed are never skipped: if an external engine is busy, built-in passive checks and a lab speed estimate for mobile and desktop still produce a score. A section you did not select shows Not selected and is left out of the average.

Individual findings are labeled Fix now, Fix soon or Worth fixing based on severity, so you always know where to start.

What the scanner can and can't see

The scanner examines your site from the outside, exactly what an attacker sees without logging in. It can find exposed files, missing headers, known vulnerable software versions, injected scripts on public pages, SEO issues and speed problems.

It can't look inside your server, read your database, or find backdoors hidden in PHP files, those need an internal, file-level scan. Think of this as your early-warning system: fast, free, and honest about its limits. See the Disclaimer for the full picture.

Is scanning safe for my site?

Yes, for sites you own. The scan sends harmless, read-only test requests, it never changes, deletes or damages anything. Polite rate limits keep the load light, and intrusive or destructive test types are excluded entirely.