Audit any website like a professional security team
Paste a URL. VulScan Pro runs a comprehensive, non-intrusive assessment of transport security, configuration, exposure, dependencies and email posture — then hands you a prioritised report with proof and remediation, ready to download as PDF.
No account, no quota. Only scan systems you own or are authorised to test.
- Domains scanned
- 29
- Scans run
- 106
- Findings fixed
- 36
- Average score
- 64
70+ checks and 40 exposure probes per scan · free, no account, no quota
What the engine inspects
Every module returns findings only when it has evidence. No inventory theatre, no fake CVE matches.
TLS & transport
Certificate chain, expiry, negotiated protocol and cipher, HTTPS downgrade paths.
Security headers
CSP quality, HSTS, clickjacking, MIME sniffing, referrer and permissions policy.
Exposed artefacts
40+ probes for .git, .env, backups, SQL dumps, actuator, swagger and debug consoles.
Technology & CVEs
Stack fingerprinting mapped to known CVEs — including PHP2Shell (CVE-2026-109618/109619) — plus end-of-life detection.
Email authentication
SPF, DMARC policy and DKIM alignment — the controls behind brand spoofing.
Network exposure
DNS records, DNSSEC, CDN/WAF detection and reachable database ports.
Application review
Forms, CSRF tokens, mixed content, SRI, leaked secrets and source maps.
Actionable report
Severity, CVSS, evidence, CWE/OWASP mapping and a concrete fix per finding.
Built for clarity
Each finding carries severity, CVSS, confidence, the exact request/response evidence, a CWE and OWASP mapping, and the remediation that actually closes it.
$ vulscan https://example.com
[transport] TLS 1.3 · cert valid 68d · HSTS ok
[headers] CSP weak (unsafe-inline) · XFO set
[exposure] /.git/config -> 404
/.env -> 404
[components] jQuery 3.4.1 -> CVE-2020-11022 (medium)
[email] SPF ok · DMARC p=none (spoofable)
[network] 443 open · 3306 closed · DNSSEC signed
score 78/100 grade C 9 findings 8.4sFrequently asked questions
What we check, what we never touch, and how the score is produced.
What does VulScan Pro check on a website?
- TLS configuration and certificate chain, HTTP security headers, commonly exposed files, detected technologies against known CVEs, DNS and email posture (SPF, DMARC, DKIM, DNSSEC), and open ports. Every finding ships with evidence and a remediation hint.
Do I need to install an agent or give access to my server?
- No. Every check is black-box and runs from the outside against the public URL, so nothing is installed and no credentials are requested.
Is scanning someone else's website allowed?
- Only scan sites you own or are authorized to test. VulScan Pro performs passive, non-intrusive checks, but authorization remains your responsibility.
How is the score calculated?
- Findings are weighted by severity. Critical and high issues reduce the score sharply while informational findings barely move it, producing a 0-100 score and a letter grade.
Is there a free scan?
- Yes. A single scan needs no account. Continuous monitoring, history, and alerts belong to the paid tiers.
Start with one URL
No sign-up needed — paste a domain and the report streams back in seconds.