Free website security scanner — check in seconds

Most site owners don’t know what their website looks like from an attacker’s perspective — until it’s too late. That’s why we’ve released a free website security scanner: you enter a domain and within seconds get a clear report with a score, a list of issues and concrete recommendations. No registration and no payment. The report automatically receives a hard-to-guess shareable link. This post explains what the scanner checks, how it works and how to get the most out of it.

What the Breachroad scanner is

It’s a tool for an automated review of the security configuration of a public website. It combines passive HTML and header analysis with light active checks: selected public paths (including .git, .env and panels), the OPTIONS method and CORS configuration. It does not run exploits, authenticate or modify the target. It’s the equivalent of a quick screening: in seconds it shows the most common gaps and gives a starting point for fixing them.

You’ll find it at breachroad.com/en/scan. Enter a domain (e.g. yourcompany.com), click “Run scan” and a moment later you see the report.

What exactly it checks

The scanner combines a dozen or so checks into one report:

• Encryption and transport — whether the site enforces HTTPS and redirects HTTP traffic, and whether HSTS is set.
• Security headers — Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy. This layer protects users against XSS attacks and clickjacking.
• Cookies — whether the Secure, HttpOnly and SameSite flags are set.
• Email security — SPF, DKIM and DMARC and MX records, i.e. protection against your domain being spoofed in email.
• DNS hygiene — DNSSEC and CAA records.
• Server and file exposure — whether headers don’t leak software versions and whether sensitive files (e.g. .git, .env) aren’t publicly accessible, with false-positive protection.
• Library vulnerabilities — detecting outdated versions of popular JS libraries with known CVEs.
• Technologies and subdomains — fingerprinting the technology stack and mapping subdomains from public Certificate Transparency logs.
• Email address exposure and public paths (robots.txt, sitemap.xml, security.txt).

At the end the scanner produces a 0–100 score, an A–F grade and a risk level, plus a list of top issues and recommendations.

A report under its own link

We automatically save each report under a hard-to-guess address (/s/…), so you can:

• share the report with your team or client via a single link,
• come back to the result later and compare it after you deploy fixes.

The report expires automatically after 90 days, and anyone who knows the link can open it. We don’t sell or profile this data — it’s still a security tool, not an ad database. The free plan allows 2 scans per day from one IP address.

How to use it

1. Go to breachroad.com/en/scan and enter your domain.
2. Wait a few seconds for the report.
3. Review the score and risk level, then the findings section — each has a description, a recommendation and a classification (CWE, OWASP).
4. Download the report as PDF or JSON, or share the generated link.
5. Fix the gaps found and rescan. How to read the result and what exactly to fix is covered in a separate post: how to read your scan results and fix the issues.

What the scanner does NOT replace

We want to be fully honest here: an automated scanner shows the tip of the iceberg. It checks configuration visible from outside, but it won’t find application logic flaws, access control gaps (IDOR), or vulnerabilities like SQL injection or XSS that require active testing. Those are only found by a manual penetration test. The scanner is an excellent first step and a free hygiene tool — but not an audit.

Frequently asked questions (FAQ)

Is the scanner really free? Yes, entirely — no registration, account limits or fees. We built it as a tool that genuinely helps raise the security level of the web, and we treat it as a showcase of our approach to security.

Can I scan any website? The scanner only queries publicly available, non-invasive information, so it’s safe to use. Local and private addresses (localhost, internal networks, metadata IPs) are blocked. It’s best to scan your own domains — you’ll get a report you can act on immediately.

Will scanning harm my site? The scanner makes a limited number of light active checks for public paths, OPTIONS and CORS. It does not test exploits, authenticate, use brute force or modify data on the server.

What do the score and grade mean? The score starts at 100 and drops for missing protections; the A–F letter and risk level (low/medium/high) are a shorthand to help prioritise. It’s a hint on where to start — not a substitute for a full audit. How to read the result exactly is explained in a separate guide.

I found issues on my site — what next? Start with the report’s recommendations; most gaps (headers, cookies, SPF/DMARC) you fix in server or DNS configuration. If you want the full risk picture, or your site processes data and payments, book a free consultation — we’ll help plan a penetration test and audit.

Summary

The free Breachroad scanner is a quick way to see your site through an attacker’s eyes: HTTPS, headers, cookies, email security, file exposure, vulnerabilities affecting detected library versions checked against the current OSV database and more — in seconds, with a report under its own shareable link. It’s a great first step to closing the most common gaps. Try it at breachroad.com/en/scan, and if you want to go deeper than an automated scan allows — let’s talk about a full test.

---

The scanner runs passive and light, non-invasive checks. It’s not a substitute for a manual penetration test. Questions or suggestions? Get in touch.