Audit any website like a professional security team
Paste a URL. VulScan Pro runs a comprehensive, non-intrusive assessment of transport security, configuration, exposure, dependencies and email posture — then hands you a prioritised report with proof and remediation, ready to download as PDF.
No account, no quota. Only scan systems you own or are authorised to test.
- Checks per scan
- 70+
- Probes
- 40
- Stack explained
- Yes
- PDF report
- Free
What the engine inspects
Every module returns findings only when it has evidence. No inventory theatre, no fake CVE matches.
TLS & transport
Certificate chain, expiry, negotiated protocol and cipher, HTTPS downgrade paths.
Security headers
CSP quality, HSTS, clickjacking, MIME sniffing, referrer and permissions policy.
Exposed artefacts
40+ probes for .git, .env, backups, SQL dumps, actuator, swagger and debug consoles.
Technology & CVEs
Stack fingerprinting mapped to known CVEs — including PHP2Shell (CVE-2026-109618/109619) — plus end-of-life detection.
Email authentication
SPF, DMARC policy and DKIM alignment — the controls behind brand spoofing.
Network exposure
DNS records, DNSSEC, CDN/WAF detection and reachable database ports.
Application review
Forms, CSRF tokens, mixed content, SRI, leaked secrets and source maps.
Actionable report
Severity, CVSS, evidence, CWE/OWASP mapping and a concrete fix per finding.
Built for clarity
Each finding carries severity, CVSS, confidence, the exact request/response evidence, a CWE and OWASP mapping, and the remediation that actually closes it.
$ vulscan https://example.com
[transport] TLS 1.3 · cert valid 68d · HSTS ok
[headers] CSP weak (unsafe-inline) · XFO set
[exposure] /.git/config -> 404
/.env -> 404
[components] jQuery 3.4.1 -> CVE-2020-11022 (medium)
[email] SPF ok · DMARC p=none (spoofable)
[network] 443 open · 3306 closed · DNSSEC signed
score 78/100 grade C 9 findings 8.4sStart with one URL
No sign-up needed — paste a domain and the report streams back in seconds.