Protego field desk
PROTEGO
Instrument 00 / Website posture

Website security checker

A free website vulnerability scanner for checking public configuration and exposures. Enter a domain to inspect headers, TLS, cookies, CORS, DNS, and exposed paths, then get an A-F grade with fix code you can paste into Nginx, Apache, Next.js, or Cloudflare. Read the operating guide

STATUS● Online
RUNSLoading
MODEPassive by default
What this tool checks

Check your website security in 15 seconds

Enter any domain you own to run a free website security check: an instant A-F grade, every finding explained, and fix instructions. No signup.

⚠️

Authorized scanning only. Only scan websites you own or have explicit permission to test. Unauthorized scanning may violate laws and terms of service.

How to scan your website in 3 steps

  1. Enter your domain or URL: paste any public-facing URL (e.g. https://example.com) into the Target URL field below.
  2. Click "Scan Now": the tool checks SSL/TLS, security headers, cookie flags, WAF presence, HTTPS redirect, and server disclosure in seconds.
  3. Review your security score: each finding is rated Critical / High / Medium / Low with a plain-English explanation and a recommended fix.

What does this website vulnerability scanner check?

This website vulnerability scanner checks public HTTP responses, TLS certificates, cookies, and DNS configuration. Deep Scan adds selected exposed-path probes and checks for recognizable vulnerable JavaScript libraries. Use the findings to prioritize fixes, then rescan to verify observable changes. It does not sign in, test application permissions, or replace a penetration test.

Common Vulnerabilities This Scanner Detects

  • Missing HTTP Security Headers: Headers like Content-Security-Policy and X-Frame-Options prevent XSS, clickjacking, and data injection attacks.
  • SSL/TLS Misconfigurations: Expired certificates, weak cipher suites, or missing HSTS leave traffic exposed to interception.
  • Exposed Admin Panels: Publicly accessible /admin, /wp-admin, or /phpmyadmin paths are prime attack targets.
  • Directory Listing Enabled: Servers that expose file directories leak sensitive information to anyone who visits.
  • Outdated Software Fingerprints: Revealing CMS or server version information helps attackers find known exploits.
  • CORS Misconfiguration: Overly permissive cross-origin policies (e.g., Access-Control-Allow-Origin: *) let malicious sites read your API responses.
  • Insecure Cookie Attributes: Session cookies missing Secure, HttpOnly, or SameSite flags can be stolen via XSS or sent in cross-site requests.
  • Mixed Content (HTTP over HTTPS): Loading HTTP resources on an HTTPS page breaks the security boundary and exposes users to man-in-the-middle injection.
  • Subdomain Takeover: Dangling DNS CNAME records pointing to deprovisioned services allow attackers to claim the subdomain and serve malicious content.
  • Vulnerable JavaScript Libraries: Outdated frontend libraries with known CVEs (e.g., old versions of jQuery or lodash) can be exploited directly in the browser.

After Your Scan: What To Do Next

After scanning, prioritize fixing critical and high-severity findings first. For missing security headers, most can be added in minutes via your web server or CDN configuration. For SSL issues, tools like SSL Labs (ssllabs.com/ssltest) provide a detailed certificate analysis. For deeper penetration testing beyond automated scanning, consider hiring a certified security professional (OSCP, CEH).

Security Headers Explained

Each missing security header is a potential attack vector. Here is what each header does and why it matters.

Content-Security-Policy

HIGH

Prevents XSS attacks by controlling which resources the browser can load. The single most impactful security header for modern web apps.

Strict-Transport-Security (HSTS)

HIGH

Forces browsers to use HTTPS for all connections, preventing SSL stripping and protocol downgrade attacks.

X-Frame-Options

MEDIUM

Prevents clickjacking by controlling whether your page can be embedded in iframes on other sites.

X-Content-Type-Options

MEDIUM

Stops browsers from MIME-sniffing responses, preventing drive-by download attacks from malicious file types.

Referrer-Policy

LOW

Controls how much referrer information is sent with requests, protecting user privacy and sensitive URL parameters.

Permissions-Policy

LOW

Restricts access to browser APIs like camera, microphone, and geolocation: limiting what malicious scripts can do.

How to Add Security Headers

Platform-specific instructions for adding all recommended security headers to your website.

Nginx

# Add to your server {} block in nginx.conf
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header Content-Security-Policy "default-src 'self'" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;

Apache

# Add to .htaccess or httpd.conf
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Header always set Content-Security-Policy "default-src 'self'"
Header always set X-Frame-Options "SAMEORIGIN"
Header always set X-Content-Type-Options "nosniff"
Header always set Referrer-Policy "strict-origin-when-cross-origin"
Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"

Next.js

// next.config.js or next.config.ts
const nextConfig = {
  async headers() {
    return [{
      source: '/(.*)',
      headers: [
        { key: 'Strict-Transport-Security', value: 'max-age=31536000; includeSubDomains' },
        { key: 'Content-Security-Policy', value: "default-src 'self'" },
        { key: 'X-Frame-Options', value: 'SAMEORIGIN' },
        { key: 'X-Content-Type-Options', value: 'nosniff' },
        { key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' },
        { key: 'Permissions-Policy', value: 'geolocation=(), microphone=(), camera=()' },
      ],
    }]
  },
}

Cloudflare

// Cloudflare Workers (cloudflare-headers.js)
addEventListener('fetch', event => {
  event.respondWith(addSecurityHeaders(event.request))
})

async function addSecurityHeaders(request) {
  const response = await fetch(request)
  const newHeaders = new Headers(response.headers)
  newHeaders.set('Strict-Transport-Security', 'max-age=31536000; includeSubDomains')
  newHeaders.set('X-Frame-Options', 'SAMEORIGIN')
  newHeaders.set('X-Content-Type-Options', 'nosniff')
  newHeaders.set('Referrer-Policy', 'strict-origin-when-cross-origin')
  return new Response(response.body, { ...response, headers: newHeaders })
}
// Or use Cloudflare Transform Rules → Modify Response Headers (no coding needed)

Best Website Security Tools & WAF Providers (2026)

Our free scanner identifies issues. These tools provide ongoing protection with firewalls, malware scanning, and real-time monitoring.

ToolTypePriceKey FeaturesLink
Sucuri Platform
Recommended for managed protection
WAF + cleanup + monitoringFrom $199/yrFirewall included in the Platform plan, plus malware removal, continuous monitoring, and DDoS protectionCompare plans
Cloudflare
Free tier for CDN and basic WAF
CDN + WAFFree / $20/moWAF, DDoS protection, CDN, SSL, bot managementVisit
Wordfence
WordPress Security
Plugin + WAFFree / $119/yrFirewall, malware scan, login security, 2FAVisit
SiteLock
Automated scanning
Scanner + WAF$15/moDaily scanning, auto-fix, PCI compliance, WAFVisit
Qualys
Enterprise-grade
VMDR PlatformCustom pricingContinuous scanning, compliance, asset inventoryVisit

Website Security Audit Checklist

SSL/TLS

  • Valid SSL certificate installed
  • TLS 1.2 or 1.3 only (disable 1.0/1.1)
  • HSTS header with long max-age
  • No mixed content warnings

HTTP Headers

  • Content-Security-Policy configured
  • X-Frame-Options: DENY or SAMEORIGIN
  • X-Content-Type-Options: nosniff
  • Referrer-Policy set appropriately
  • Permissions-Policy restricting APIs

Authentication

  • Strong password policy enforced
  • Multi-factor authentication (MFA) enabled
  • Rate limiting on login endpoints
  • Secure session management

Infrastructure

  • Web Application Firewall (WAF) active
  • DDoS protection enabled
  • Server version headers hidden
  • Regular security patches applied

How the Vulnerability Scanner Works

A passive, non-intrusive security assessment that returns results in seconds: no installation required.

1

What the scanner checks

The scanner performs a multi-layer passive assessment of your website. It inspects all major HTTP security headers (including Content-Security-Policy, Strict-Transport-Security (HSTS), X-Frame-Options, and Referrer-Policy) and scores each against industry best practices. SSL/TLS certificates are validated for expiry, issuer trust, and protocol version. Cookie attributes (Secure, HttpOnly, SameSite) are analyzed for session-hijacking risks. The scanner also checks for WAF presence, CORS policy misconfigurations, server version disclosure, and the existence of a security.txt file.

2

Deep Scan mode

Deep Scan goes beyond response headers and performs active path discovery. It also scans the page source for accidentally exposed credentials: API keys, tokens, and secrets that were mistakenly shipped in frontend code. The scanner looks for GitHub personal access tokens, Stripe live secret keys, SendGrid API keys, AWS access key IDs, Google API keys, Slack bot tokens, and hardcoded api_key or api_secret assignments. Any match is flagged as Critical or High severity so you can rotate the credential immediately.

Beyond credentials, Deep Scan probes for exposed sensitive paths (e.g., /admin, /.env, /backup.zip), checks for legacy TLS 1.0/1.1 support, detects vulnerable JavaScript libraries with known CVEs, audits robots.txt for sensitive path disclosure, flags mixed content, verifies Subresource Integrity (SRI) on external scripts, and detects dangerous HTTP methods like PUT and DELETE. Deep Scan takes slightly longer but surfaces the findings most commonly exploited in real attacks.

3

Shareable scan reports

Once a scan completes, you can copy a unique shareable URL directly from the results panel. The link encodes the full scan output (score, grade, all findings, and remediation advice) so you can share it with a developer, client, or security team without requiring them to re-run the scan. Report links work for anyone with the URL and do not require a Protego account to view.

4

Data privacy

Scans are not permanently stored on Protego servers. The tool makes outbound HTTP requests to the target URL you provide and returns the analysis directly to your browser. No login is required to use the scanner, and we do not build profiles of scanned domains. For sensitive internal environments, always ensure you have explicit authorization before scanning.

AI-built website launch check

Built your site with AI? Check it before you launch

An app built with Lovable, Bolt.new, Cursor, v0, Replit, or Claude Code can have security flaws even when its preview works. Use this scanner on your own deployed domain to check public configuration and recognizable exposures, then separately test permissions and application logic before launch. A clean grade is not a launch safety certificate.

What this scanner checks vs what it can’t

Start with the standard scan

Check missing or weak security headers such as CSP, HSTS, and X-Frame-Options, TLS certificate issues, insecure cookie flags, and overly permissive CORS settings. Standard and Deep Scan also look for recognizable secrets in fetched HTML and selected same-origin JavaScript bundles; this is not a full bundle audit.

Enable Deep Scan for public exposures

Look for recognizable exposed file contents, known-vulnerable JavaScript libraries identified from versioned script URLs, HTTP resources on HTTPS pages (mixed content), and deprecated TLS support. It does not verify admin access controls or detect directory listings.

This scanner does not test XSS, SQL injection, authentication or authorization logic, Supabase Row Level Security (RLS), or API business logic. CSP checks are not XSS testing. Review code and test user roles separately.

Pre-launch checklist for your AI-built app

  • Enable Supabase RLS on tables exposed through its API; test policies as anonymous users and different signed-in users.
  • Review client bundles for secrets. Keep private environment keys server-side, outside public-prefixed variables, and rotate any leaked credentials. Public client keys still need correct access policies.
  • Enforce authentication and authorization on API routes, including ownership checks for every requested record.
  • Add server-side rate limits to login and sensitive API actions; test input validation and error handling.
  • Configure security headers, HTTPS, secure session cookies, and intended CORS origins; rescan after deploying fixes.

Need deeper app-logic testing? Consider the hosted Strix AI pentest for automated attack testing of your public app. It does not sign in or verify Supabase RLS or cross-user permissions; those still need separate testing and review. Check the scope before ordering.

Frequently Asked Questions

Is my Lovable, Bolt.new, or v0 site secure?
The builder alone cannot tell you whether your deployed site is secure. Use this website security checker on a domain you own to inspect its public configuration, including headers, TLS, cookies, and CORS. A good grade does not verify login permissions, business logic, or Supabase row-level security (RLS).
How should I check website security before launching an AI-built website?
Run a standard scan on your deployed domain for missing security headers, TLS issues, insecure cookie attributes, and CORS misconfiguration. Enable Deep Scan to check recognizable exposed files, known-vulnerable JavaScript libraries identifiable in script URLs, mixed content, and legacy TLS support. Separately review authentication, authorization, and database access policies before launch.
Can a free website security test find every vulnerability?
No. This scanner inspects public responses and selected exposed paths, without signing in or testing every application workflow. When you scan a website for vulnerabilities, treat the results as a starting point and arrange a code review or manual penetration test for access controls, business logic, and Supabase RLS.
How do I fix scanner findings in a site built with an AI app builder?
Give your AI coding tool the specific finding and the relevant fix instructions, then review the proposed changes before deploying. Header fixes may belong in your Next.js app or Vercel or Netlify configuration, while cookie and CORS fixes may belong in the backend that sets them. Test that login and integrations still work, then rescan the deployed domain to verify the observable fix.
What does the Protego website security checker check for?
The scanner checks HTTP security headers (Content-Security-Policy, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy), SSL/TLS certificate validity and configuration, cookie security attributes (Secure, HttpOnly, SameSite), CORS policy, WAF detection, server version disclosure, and security.txt presence. With Deep Scan enabled, it also probes for exposed sensitive paths, legacy TLS versions, vulnerable JavaScript libraries, mixed content, and dangerous HTTP methods.
Is the website security checker free to use?
Yes. Standard and Deep Scan modes are free. To prevent automated abuse, visitors can run three scans per day without an account, while signed-in users can run ten scans per day. Limits reset at midnight UTC.
How can I check website security, and when do I need a penetration test?
Start with a free website security check on a domain you own. Review the findings, apply the relevant fixes, then rescan to verify the observable changes. This checker inspects HTTP response headers, TLS certificates, cookies, DNS records, and public responses. It does not sign in or attempt to exploit vulnerabilities. A penetration test goes deeper into application behavior and exploitability within an agreed scope, including authentication, access controls, and business logic where covered. A clean scanner grade does not prove those controls are secure.
What is Deep Scan mode?
Deep Scan extends the standard check with active path probing and client-side analysis. Every scan, standard or deep, also checks the page source and selected same-origin scripts for accidentally exposed secrets including GitHub tokens, Stripe live keys, SendGrid API keys, AWS access key IDs, Google API keys, Slack bot tokens, and hardcoded api_key or api_secret assignments. If any are found, the scan flags them as Critical or High severity so you can rotate them immediately. It also attempts to access selected commonly exposed paths (admin panels, backup files, environment files), checks for TLS 1.0/1.1 support, detects frontend JavaScript libraries with known CVEs, audits robots.txt for sensitive disclosures, checks for mixed content, and tests for dangerous HTTP methods (PUT, DELETE, TRACE). It takes a few extra seconds but surfaces the findings most relevant to real-world attackers.
Can I share my scan results?
Yes. After a scan completes, use the Copy Shareable Link button to get a URL that encodes the full report. Anyone with the link can view the results including score, grade, all findings, and fix recommendations without running a new scan or creating an account.
How often should I scan my website?
Rescan after deployments and changes to hosting, certificates, headers, cookies, or CORS. Choose an ongoing review schedule based on your application risk and obligations. A scan alone does not establish compliance.
What is a CSP header and why does it matter?
A Content-Security-Policy (CSP) header tells the browser which sources are allowed to load scripts, styles, images, and other resources. Without it, attackers can inject malicious scripts via XSS attacks. Common misconfigurations include using unsafe-inline or unsafe-eval, which weaken protection. The scanner checks for these issues and suggests a hardened policy.
What does HSTS preload mean?
HSTS (HTTP Strict Transport Security) forces browsers to use HTTPS. HSTS preloading goes further: your domain is added to a list built into Chrome, Firefox, and Edge, so HTTPS is enforced before the browser ever makes a request. Without preloading, the very first visit could be over HTTP. Check and submit your domain at hstspreload.org.
How does the website security checker grade my site?
The scanner starts at 100 and deducts points for each issue found: missing security headers (-4 to -15 pts each), invalid SSL (-30 pts), no HTTPS redirect (-8 pts), insecure cookies (-3 to -5 pts each), CORS misconfiguration (-8 to -20 pts), and more. The final score maps to a letter grade: A+ (90-100), A (80-89), B (70-79), C (60-69), D (50-59), F (below 50).
Does this scanner test XSS or SQL injection in my Cursor or vibe-coded app?
No. It checks CSP as a browser-side defense, but does not inject XSS or SQL injection payloads. It does not test authentication or authorization logic, Supabase Row Level Security, or API business logic. Review code and test those controls separately.
Does a clean scan mean my Supabase app is safe to launch?
No. Enable RLS on tables exposed through the Supabase API and test policies as anonymous users and different signed-in users. Check that each user can access only the intended rows. This scanner cannot verify those policies or cross-user permissions.
Can the scanner find secrets in an AI-built app?
Standard and Deep Scan look for recognizable credential patterns in the fetched HTML and selected same-origin JavaScript bundles. This is a bounded check, not a complete source or bundle audit. Review the build output yourself, keep private keys server-side, and rotate exposed secrets even after removing them.

Related Tools & Reading

Tool

SSL Certificate Checker

Deep-dive SSL/TLS analysis with certificate monitoring

Tool

HTTP Security Headers Checker

Inspect all HTTP response headers for any URL

Tool

Email Security Checker

SPF, DKIM, DMARC, and spoofing risk for the same domain

Article

How to Check if a Website Is Hacked

What to do after a bad grade, malware warning, or unexplained redirects

Built by Idan Ohayon at Protego : Microsoft Cloud Solution Architect & cybersecurity practitioner.