SSL and HTTPS
Certificate trust and expiry, the HTTP to HTTPS redirect, HSTS and mixed content.
How to fix it Free online security scan · no credit card
Free website vulnerability scanner for your live app.
Enter your URL. The scanner reads up to 25 pages and checks for exposed files, missing security headers, weak cookie flags, SSL problems and risky configuration. Each finding is listed by severity with the URL where it was seen.
Free scan, no card. Free account to see the full report. One fix included.
60+ automated checksUp to 25 pagesAffected URL on every findingOnly scan sites you own or may test
scanmysaas.com/scan/…Sample report
60+ checks
What the free website vulnerability scanner checks
Security headers
Content-Security-Policy parsed the way browsers enforce it, clickjacking protection, MIME sniffing, referrer and permissions policies.
How to fix itExposed files
Public .env files, Git metadata, database dumps, backups and logs. A file only counts as exposed when its content looks like the real thing, so a custom 200 page does not trigger it.
How to fix itCookies and forms
Secure, HttpOnly and SameSite on every cookie the server sets across the crawled pages, plus forms with no visible CSRF token.
Client-side code
Unsafe DOM sinks in inline scripts, old jQuery, AngularJS 1.x and Bootstrap 3 builds, third-party scripts without integrity hashes, and public source maps.
How to fix itExposure and configuration
Debug endpoints, GraphQL introspection, CORS that reflects any origin with credentials, directory listings, TRACE, and SPF and DMARC records.
Crawl readiness
robots.txt, XML sitemap, canonical URL, indexability, llms.txt and security.txt. These are reported separately and do not change the security score.
How to fix itA fix you can paste into your AI tool
The free report includes one prioritized fix with a prompt for Cursor, Claude or Codex. Paid plans add a fix and a prompt for every finding.
From URL to verification
Submit an authorized URL, crawl up to 25 pages, run 60+ checks, review findings and affected URLs, confirm and fix with your coding tool, then rescan.
How the website vulnerability scanner works
- 01
Crawl
The scanner opens your URL and follows links in the HTML the server returns, up to 25 pages. It waits up to 15 seconds for each one.
- 02
Probe and read
It requests more than 40 paths that should never be public (such as /.env, /.git/config and /backup.sql), reads response headers and cookies, checks the TLS certificate, and looks up SPF and DMARC records.
- 03
Report
Findings are sorted by severity, each with the URL where it was seen. Fix the top one, deploy, and rescan to confirm it is gone.
What the free scan does not test
A clean report means the public surface looks right. It does not mean the app is safe. These gaps need a different tool or a manual test:
- Pages behind a login. The scanner never signs in.
- SQL injection, XSS or other attack payloads. Injection is only reviewed through signals like unsafe inline script sinks and a CSP that allows inline scripts.
- Open redirects and business logic, such as one user reading another user's data.
- Headers on every page. Response headers and CSP are read from the first page.
- Every route of a single-page app. React, Vite and Lovable apps render in the browser, so the crawler often sees only the pages linked in the first HTML response.
For the code behind the site, use the GitHub repo scanner. Built with Lovable? The Lovable security scan covers both sides.
OWASP Top 10:2025 coverage
How the checks map to the OWASP Top 10:2025. Categories not listed (A06, A08, A09, A10) are design and process issues an outside scan cannot judge.
| Category | What the scan checks |
|---|---|
| A02 Security Misconfiguration | Security headers and CSP, CORS reflection, directory listings, debug endpoints, GraphQL introspection, TRACE, exposed files |
| A04 Cryptographic Failures | TLS trust and expiry, HTTPS redirect, HSTS, mixed content, Secure cookie flag, forms posting over HTTP |
| A03 Software Supply Chain Failures | Old jQuery, AngularJS and Bootstrap builds, third-party scripts without integrity hashes |
| A05 Injection | Signals only: unsafe inline DOM sinks and CSP that allows inline scripts. No payload testing |
| A01 / A07 Broken Access Control, Authentication Failures | Not testable from outside beyond cookie flags. Use the repo scan (AI review on paid plans) and a two-account test |
Scan the GitHub repo behind the site
Committed API keys, risky GitHub Actions and Supabase tables created without row level security never show up in a website scan. The GitHub repo scanner reads the code and points to the file and line. Public repos are free; private repos connect through a read-only GitHub App on Starter or Pro, where an AI review also looks for routes that skip ownership checks.
Two views of your app
Website scan sees
- TLS and HTTPS
- Headers and cookies
- Exposed files and source maps
- CORS responses
your app
Repo scan sees
- Committed secrets / public env vars
- RLS signals in migrations
- GitHub Actions and dependencies
- Selected routes: paid AI review
Website scans inspect public TLS, headers, cookies, files, source maps and CORS. Repository scans inspect committed secrets, migration RLS signals, Actions, public environment variables and dependencies. Paid AI review inspects selected routes; neither view proves security.
scanmysaas.com/scan/…Sample report
FAQ
Free website vulnerability scanner FAQ
Is this website vulnerability scanner really free?+
Yes. Your first scan of a website is free, with no card. The preview includes a security score, severity counts and one complete finding with a fix when available. A free account opens the affected URLs and descriptions for every finding, keeps the report and gives you one free rescan of the same site within 7 days, with a list of what was fixed and what is new.
How long does a website security scan take?+
It depends on how fast your pages respond. The scanner reads at most 25 pages and waits up to 15 seconds for each, so a slow site takes longer than a fast one.
Is the scan safe for my website?+
The scan sends ordinary GET requests to up to 25 of your pages and to more than 40 known sensitive paths such as /.env, /.git/config and /graphql. It also sends one TRACE request, one request with a test Origin header to check CORS, and a read-only GraphQL introspection query if a GraphQL endpoint answers. It does not log in, submit your forms, send attack payloads or change data. Scan only websites you own or are authorized to test.
What does a free online vulnerability scan not cover?+
Anything that is not visible from the outside: pages behind login, server code, database rules and business logic. It is not a penetration test and it does not send attack payloads. To check the code, use the GitHub repo scanner. It reads your repository for committed secrets and risky workflows, and on Starter and Pro an AI review also reads server routes for missing ownership checks.
How many free scans do I get?+
Without an account, one scan per website. With a free account you can keep the report and rescan the same site once within 7 days to confirm a fix. More scans use credits from the Starter or Pro plan.
What should I do after the scan?+
Start with critical and high findings. Use the fix, or the prompt for your coding tool, deploy the change and rescan to confirm it is resolved. Then scan the repository behind the site, because committed secrets and database rules do not show up from the outside.
Need more than one scan? See vulnerability scanner pricing. For what a scanner cannot check, work through the vibe coding security checklist or the SaaS launch checklist.