WebScanify checks your website for security issues and can provide AI-assisted explanations and remediation guidance. Findings and guidance require review.
When available, the AI advisor analyzes selected scan outputs, can suggest additional checks and potential attack chains, and provides remediation guidance. Suggestions and correlations require independent verification and do not establish exploitation.
Critical: Missing Content-Security-Policy
Your site has no Content Security Policy. This means an attacker who injects code into your page can freely load resources from anywhere - including stealing your users' passwords or session cookies.
Fix: Add a Content-Security-Policy header to your server config. Start with default-src 'self'. This single change blocks an entire class of injection attacks.
Automated checks examine selected external security indicators. Coverage depends on the target and scan configuration.
Verifies your certificate is valid, not expiring soon, and using strong encryption. Flags weak protocols like TLS 1.0 and self-signed certs before they break user trust or trigger browser security warnings.
Checks all critical HTTP security headers - CSP, HSTS, X-Frame-Options, and more. Missing headers are among the most common and easiest-to-exploit weaknesses attackers look for first.
Detects which software and libraries your site runs, then checks them against the NIST vulnerability database in real time. Always current - no stale offline lists.
Updated DailySpecialised checks for WordPress, Drupal, Joomla, and Magento. Finds outdated plugins, exposed admin pages, user enumeration, and known CMS attack vectors that generic scanners miss.
Discovers some subdomains and checks for indicators of potentially vulnerable cloud-service references. Discovery and takeover detection are not exhaustive.
Enumerates selected subdomains and ports to help identify parts of your external attack surface. Results are not a complete inventory.
Paid scans can use supplied credentials for supported authenticated checks. Login and protected-page coverage depend on the target and authentication method.
Discovers hidden API endpoints and analyses JavaScript files for leaked secrets, exposed credentials, unsafe libraries, and access control issues traditional scanners overlook.
Some checks collect evidence of potential weaknesses and the advisor can suggest attack chains. Configuration observations and suggested chains are not proof of exploitation; active requests may affect a target.
Checks observed cookies for selected security flags and potential privacy and session-handling issues. It cannot determine all consent or legal obligations.
Identifies whether a Web Application Firewall is protecting your site, which vendor it is, and whether it is configured to actually block attacks - not just sit there quietly.
Share a secure read-only scan report link with clients or stakeholders - no login required on their end. Your branded report, their peace of mind.
Display a live trust badge on your website showing your security grade (A+, B, C, etc.) based on your latest scan. Updates dynamically without caching issues.
Export results as a polished HTML, JSON, or PDF. Includes an executive summary, risk score, findings table, and remediation roadmap - ready to share with clients or management instantly.
Checks whether your domain appears on public malware or threat intel feeds, and - when the HIBP integration is enabled - whether associated email addresses appear in known data breach databases.
Checks DNS configuration, SPF/DKIM/DMARC email security records, WHOIS ownership, and zone transfer exposure - the infrastructure layer most scanners skip entirely.
Retest individual security modules (SSL, Headers, WAF, Ports, CVEs, XSS) in ~2 seconds to verify your patches instantly without burning monthly scan credits.
Confirms SQLi, XSS, IDOR, CSRF, SSRF, and Template Injection with proof-of-exploit payloads to isolate actionable findings and reduce false positives.
Export scan findings in standard Static Analysis Results Interchange Format (SARIF) to display vulnerabilities directly in your GitHub Actions & GitLab Security tabs.
Scans client JavaScript files to detect leaked AWS tokens, Google API keys, Firebase credentials, private RSA keys, and Stripe secrets before hackers do.
Automatically discovers endpoints, tests for broken object-level authorization (BOLA), mass assignment, and audits exposed OpenAPI / Swagger documentation schemas.
Submit multiple targets in a scan action, subject to your plan and service limits. Scans are queued for background processing; active checks may still affect a target.
Reports map selected technical observations to framework controls. Depending on coverage, checks may include public TLS, HTTP headers, cookies, DNS and exposed application responses; authenticated checks are limited to access you provide. Crawling and individual checks are bounded and may miss pages. Internal systems, source code, policies, personnel, physical security, legal obligations and operating effectiveness over time require separate review. Scores are not certification; unavailable checks provide no evidence of a pass.
Free scans provide a high-level overview; paid plans provide additional findings and reports. Coverage and evidence depend on the target and checks performed. All scans require ownership or explicit authorisation for every asset tested.
Create a free account and run your first scan at no cost. No credit card needed.