Full check list
Every check we run, and when.
Most scanners publish a number and leave you to trust it. This is the whole list. Each row says what is actually tested, how many discrete probes or patterns it covers, and which kind of scan it runs in, so you can tell what a free scan really gives you.
The headline number is the full suite, not a free scan. A free scan runs 430 of these 800 checks. The remaining 370 either send traffic patterns we will only point at a domain whose owner has verified it, or take long enough that we do not run them on an unauthenticated request.
That gap is the honest answer to "what do I get for free". Every row below is labelled, so you never have to infer it.
Access tiers
What has to be true before a check runs
The deeper a check probes, the more we need to know you own the target. Ownership verification is the line, not the price.
Runs on every scan, including the free one. No signup or ownership proof needed.
Deep scan only. Requires a paid plan and a verified domain.
Deep scan on a domain you have proven you own. Never runs on a domain you do not control.
Deep scan on a verified domain with active testing explicitly authorized. Sends crafted input to your own site.
The list
800 checks across 9 categories
The first seven categories are the evidence surfaces your grade is calculated from. The last two are reported alongside it: content integrity is scored, compliance never is.
Secrets & Credentials
Anything that hands an attacker a working key. These are the findings that turn a curious visitor into an authenticated one.
Live API keys and tokens in page source
Reads your HTML and JavaScript bundles looking for credential shapes that are valid on sight: provider secret keys, cloud access key IDs, repository tokens, webhook URLs, database connection strings and private keys. Known-public key formats are recorded but not treated as a leak.
Environment files served over HTTP
Requests the environment and runtime-config files that build tools commonly leave inside the deployed output. A single readable one usually contains every secret the app has.
Published source maps exposing original source
Checks whether your bundler shipped the source maps that reconstruct your original, uncompiled source code, including comments and any secret inlined at build time.
Dependency manifest readable by anyone
Looks for a publicly served dependency manifest and inspects the declared packages for install-time patterns worth a second look, such as direct archive or repository references.
Browser Security Controls
The instructions your server gives the browser. When these are missing the browser has no reason to refuse an attacker.
Security response headers
Confirms the response headers that stop framing, MIME sniffing, referrer leakage and downgrade attacks, and flags the ones that are absent or set to a value that does nothing.
Content Security Policy directives
Parses your policy directive by directive, resolves which ones silently fall back to a weaker default, and flags the values that let injected script run anyway.
Session cookie flags
Collects cookies from the entry points that actually set a session, then checks each one for the flags that keep it off plaintext connections, out of reach of JavaScript, and unattached to cross-site requests.
Cross-origin sharing policy
Tests whether your site hands its responses to origins it should not trust, including the combinations that expose authenticated data to any website a logged-in user visits.
Cross-origin policy against forged origins
Repeats the cross-origin question with origins built to defeat naive matching: a lookalike domain, a domain that merely starts with yours, a subdomain, and a null origin.
Form request forgery protection
Finds the forms that change state and checks each one for an anti-forgery token, covering the token field and meta-tag conventions used by the major frameworks.
SSL/TLS Configuration
Whether the encrypted connection is actually trustworthy, and what your certificate history reveals about the rest of your estate.
Accepted TLS protocol versions
Negotiates separately at each protocol version to find out which ones your server still accepts, rather than only recording the best one it offers.
Certificate validity, expiry and hostname match
Inspects the presented certificate for an expiry date close enough to cause an outage, a hostname that does not cover the site, and a chain that does not verify.
Certificate transparency history
Reads the public certificate transparency logs for your domain. Every certificate ever issued is listed there, which routinely reveals internal and staging hostnames nobody meant to publish.
Authentication & APIs
The endpoints behind your app. This is the largest group, because it is where an outside-in scan can most directly demonstrate real access.
API endpoints returning personal data without a login
Requests the endpoint names that frameworks and starter templates create by default, with no credentials attached, and inspects any JSON that comes back for personal data fields.
Rate limiting on API endpoints
Looks for evidence that repeated requests are actually being counted, across the response-header conventions the common gateways and frameworks emit.
Reachable network ports
Probes the ports that development servers, admin panels and management interfaces get left listening on after a deploy.
Dangerous HTTP methods
Asks each API root which methods it accepts, covering the state-changing verbs and the debug verb that can echo request headers back to an attacker.
Server errors that leak internals
Sends malformed but harmless requests and reads the error pages that come back, looking for stack traces, file paths, framework versions and database messages.
Open redirects in login and callback flows
Tries the redirect parameter names used by auth flows against the paths that carry them, checking whether your site will forward a visitor to an arbitrary external destination.
Path traversal into server files
Tests whether a crafted path can escape the intended directory and read files from the server filesystem. Runs only against a domain you have proven you own.
SQL injection in request parameters
Compares responses to logically true and false variants of the same parameter to detect a query that concatenates your input, without ever attempting to read or modify data.
Reflected cross-site scripting
Sends inert marker payloads and checks whether they come back in a position where a browser would execute them, across the HTML, attribute, script and URL contexts.
DNS & Email Security
Whether someone can send mail as you, and what your DNS reveals about the hosts you did not mean to publish.
Sender authentication and DNS integrity records
Resolves the records that decide whether a forged email from your domain is accepted, plus the signed-DNS record that stops answers being tampered with in transit.
Mail signing key discovery
Signing keys are published under a per-provider name that cannot be listed, so each candidate is queried directly to establish whether your mail is actually signed.
Extended mail signing discovery
Repeats the signing-key lookup against a broader provider list, including the selectors used by transactional and marketing senders that a standard pass does not cover.
Subdomain discovery
Resolves the hostnames that commonly exist alongside a main site, then checks each live one for a delegation pointing at a service that is no longer claimed.
Database & Storage Exposure
Whether your data is readable without an account. These are the findings that most often turn out to be a real breach rather than a hardening gap.
Anonymously readable database tables
Takes the public browser credential your own site ships, and asks your database directly for the table names an app of your kind normally has. Anything that answers with rows is readable by every visitor.
Anonymously readable document collections
Does the same for document-database collections, using the public web configuration found in your own bundle to establish whether the access rules are actually enforced.
Publicly listable cloud storage buckets
Derives likely bucket names from your domain and tests each one across the major storage providers to see whether the contents can be listed by anyone.
Config, backup and database files served publicly
Requests the configuration files, database dumps and archive names that get left in a web root, and verifies the response is really the file rather than a catch-all page.
Extended exposed-path probing
Widens the same sweep to version-control directories, admin consoles, debug and monitoring endpoints, and server status pages.
Dependencies & CVEs
The known-vulnerable software you are running. Only version-linked matches backed by an observed fingerprint are reported.
Technology and version fingerprinting
Identifies the frameworks, servers, content platforms, analytics and hosting behind your site from headers, markup and script URLs. This is what makes a version-linked vulnerability match possible.
Known vulnerabilities for detected versions
Matches the versions actually observed on your site against the national vulnerability database, and enriches each match with whether it is known to be exploited in the wild and how likely exploitation is.
Vulnerable JavaScript libraries
Detects front-end library versions from script URLs and from the version strings the libraries expose at runtime, then flags the ones with published advisories.
Open-source advisory lookup
Queries the open-source vulnerability database for every library version detected, and reports the earliest version that resolves each advisory.
Content Integrity
Whether your site shows search engines something different from what it shows visitors. This is how an SEO compromise stays invisible to the owner.
Search-engine cloaking
Fetches your pages the way a visitor does and the way a search crawler does, then compares them. A large divergence means someone is serving content you never see.
Ghost and spam page sampling
Samples URLs out of your sitemaps and checks for pages that return not-found to a visitor but a real page to a crawler, then estimates how many exist.
Reachable page and endpoint discovery
Crawls your public site to build the map of reachable pages and endpoints the other deep checks are then pointed at. Destructive-looking links are excluded rather than followed.
Compliance Signals
Reported for completeness and never scored. A missing privacy policy is a legal problem, not an attack surface, so it does not affect your grade.
Never affects your gradePrivacy policy and terms availability
Looks for reachable policy and terms pages across the common paths and several languages, and confirms the page found is really the policy rather than a redirect to the homepage.
Consent mechanism
Detects whether a consent mechanism is present, covering the major consent platforms and the tag-manager consent signals.
Third-party trackers
Identifies the analytics, advertising and session-recording services loading on your pages, which is the list that has to appear in your policy.
Vulnerability disclosure policy
Checks both standard locations for a disclosure file and validates the required and recommended fields, so a researcher who finds something has a documented way to tell you.
How we count a check
One check is one discrete probe, pattern or signature the scanner evaluates: one requested path, one credential format matched against your bundles, one mail selector resolved, one storage bucket candidate tested, one policy directive parsed. Counts come from the scanner source, and a test pins these totals so the number here cannot drift away from what the code does.
A check is not a finding. Most of these come back clean on most sites, and a check that cannot complete is recorded as unknown coverage rather than a pass. For how the results become a score, see the scoring methodology. For what we send, honor and never touch, see the scanning policy.
Start here
Run the 430 free ones now
Scan any domain in under two minutes. No signup, no card. Verify the domain afterwards to unlock the rest.
Scan a domain