HTTPS and certificate
Expiry, trust chain, HTTPS redirect, and manual renewals that will break in 2027.
Free · Passive · No signup
Website Vulnerability Scanner
Find expired certificates, end-of-life PHP, exposed files and leaked API keys in about ten seconds.
- areas checked
- 7
- areas checked
- security signals
- 40+
- security signals
- per scan
- ~10s
- per scan
- signup required
- 0
- signup required
What this website vulnerability scanner checks
The things an attacker's bot finds first.
Server software and runtime versions
Exposed PHP versions against EOL dates and the PHP2Shell fixes.
API keys leaked into client code
Stripe, OpenAI, AWS, GitHub and Supabase keys inside your JavaScript.
Files that should never be public
.env, .git, phpinfo and other files that should never be public.
Security headers
HSTS, CSP, framing, nosniff and referrer policy, with the header to add.
Cookies and mixed content
Session cookies without Secure, HttpOnly or SameSite, plus mixed content.
Why scan this month
Two critical runtime releases landed on the same day.
Oct 21
PHP2Shell
Unauthenticated RCE in PHP core, CVSS 9.2. PHP 8.1 and older get no fix.
Read the guide
Oct 21
Node.js security release
10 fixes across 22, 24 and 26, four rated high. Node 20 stays unpatched.
Read the guide
2026 → 2029
Certificates: 200, 100, then 47 days
200 days today, 100 in March 2027, 47 by 2029. Automate renewal now.
Read the guideHow the free scan works
01
Enter a domain
No signup. Confirm you are allowed to test the site.
02
Passive checks run
About 20 ordinary GET requests. No logins, payloads or port scans.
03
Fix from the report
Every finding comes with the exact setting to change.
What it never does, and what we keep+
What it does. It requests your homepage over HTTPS and HTTP, reads the response headers and TLS certificate, downloads up to eight JavaScript files from the same host, and asks for six well-known paths. That is roughly twenty ordinary GET requests, sent from an identifiable SiteXrayBot user agent.
What it never does. No login attempts, no form submissions, no injected payloads, no port scanning, no crawling beyond the homepage. Internal and private network addresses are refused, and only ports 80 and 443 are allowed. This is why it is safe to run against production, and also why it is not a penetration test.
What happens to the results. Reports are kept in memory for five minutes so repeated scans of the same site do not hit it again, then discarded. Detected secrets are masked before they leave the server. You must confirm you own the site or have permission to test it.
From report to fixed
Rather not dig through nginx configs? We fix it and keep watching.
See services and prices
- Fix sprint: one site, every finding fixed, re-scanned to an A
- Monitoring: weekly re-scans, certificate and CVE alerts
- Managed patching: PHP / Node.js upgrades and updates each month
Questions
Is this website vulnerability scanner really free?
+
Yes. The scan has no signup and no limit beyond a short pause between scans. Paid services exist for people who want the findings fixed or monitored, but the scanner itself stays free.
Is it safe to scan a production website?
+
Yes. The scanner sends about twenty normal GET requests, the same kind a browser or search engine makes. It does not submit forms, guess passwords or send attack payloads, so it cannot change data or take a site down.
Can I scan a website I do not own?
+
Only with permission. Even passive checks should be run on sites you own, manage, or have written authorization to test. You are asked to confirm this before every scan.
How do I know if my site is affected by PHP2Shell?
+
If your server reveals its PHP version, the report tells you directly. If it hides the version (which is good practice), run php -v on the server: anything below 8.2.35, 8.3.36, 8.4.27 or 8.5.12, and every 8.1 or older release, is affected unless your vendor has backported the fix.
Can it detect the Node.js version my app runs on?
+
Usually not: Node.js does not announce its version over HTTP. The scanner flags framework fingerprints such as X-Powered-By: Express. Check the runtime yourself with node -v and upgrade to 22.23.4, 24.22.1 or 26.12.1 or later; Node.js 20 needs a major upgrade.
My site got an A. Is it secure?
+
It means nothing obvious is exposed from the outside, which already puts it ahead of most sites. Logic flaws, weak passwords, vulnerable plugins behind a login and database rules are invisible to a passive scan. For those you need a code review or a penetration test.
I built my app with an AI coding tool. What should I check first?
+
Leaked keys and database rules. AI-generated front-ends often ship secret keys to the browser, and Supabase or Firebase projects often go live without row-level security. The scanner catches the first; for the second, see the vibe coding security checklist in our guides.
How often should I scan?
+
After every deploy that touches server config, and at least monthly. Certificates now renew every few months and runtimes ship security releases several times a year, so a site that was clean in spring can be failing by autumn.
Fixed something? Scan again.
Re-run the report after each change and watch the grade move.
Back to the scanner