How secure is that website, really?
One scan checks HTTPS & TLS health, security headers, cookie flags, exposed files like .env and .git, Certificate Transparency subdomains, DNS & email security, and outdated software matched against live CVE intelligence — rolled into one 0–100 score.
Want the full picture? Deep Scan is on PRO.
The free demo shows the same summary as the API's BASIC plan — score, grade and pass/fail per category. The full report on RapidAPI lists every individual finding with evidence and concrete remediation advice, and the PRO plan unlocks Nuclei-powered deep scans, single or batch.
What we check
Six categories, all gathered from ordinary public requests — nothing is installed on the target and no traffic touches it beyond what any visitor's browser would make.
HTTPS & TLS
Certificate validity and expiry, protocol versions, and whether the site forces encrypted connections end to end.
Security Headers
The response headers that stop clickjacking, MIME sniffing and cross-site scripting — checked one by one, with what's missing called out.
Cookie Flags
Whether cookies are locked down with Secure, HttpOnly and SameSite, so sessions can't be stolen or sent where they shouldn't go.
Exposed Files
Publicly reachable leftovers like .env and .git that hand attackers credentials and source code on a plate.
DNS & Email Security
SPF and DMARC records that keep strangers from sending mail as your domain — plus subdomains discoverable through Certificate Transparency logs.
Software & CVEs
Server and framework versions fingerprinted from the outside, then matched against live CVE intelligence for known vulnerabilities.
FAQ
Is the scan safe? Does it attack the site?
No. The scan is fully passive — it only reads publicly reachable information about the target using ordinary requests, the same kind any browser makes. Nothing is installed and nothing is probed aggressively.
What does the score mean?
Every check across the six categories is weighted and rolled into a single 0–100 score with a letter grade (A+ down to F). A high score means the public-facing basics are in order — it is not a guarantee that a site has no vulnerabilities, which is why the full report explains each finding individually.
What does PRO add?
The full report: every individual finding with the evidence behind it and concrete remediation advice, scan history with change diffs between scans, and Nuclei-powered deep scans (single or batch) that actively test for known vulnerability patterns.