In-depth vulnerability scan
Scan a website you own for known vulnerabilities, exposed services and weak configuration — with every finding explained in plain language. No account, no email. You prove you own the domain, run the scan, download your report, and we delete it after a few days.
What this scan does (and what it can’t)
We do two things, in order. First we map which “doors” your site opens to the internet — the network services it exposes — and work out what software is behind each one. Then we check every one of those against a large, constantly-updated library of known weaknesses. It is read-only: we look and test, but never break in, and never change anything on your site.
That second stage sends real probes to your server, which is why this scan — unlike our passive posture check — asks you to prove the domain is yours first. Proven ownership is the authorisation to test it. It usually takes a few minutes to run, and can take up to ~30 for a thorough one; you can close the page and come back to your link.
The technical detail (nmap + nuclei) — how it actually works
Stage 1 — port & service discovery (nmap). We probe the top 1,000 TCP ports to find which services are reachable (web, mail, databases, remote administration) and fingerprint what's running on each, including software and version banners where they're exposed. That map tells the next stage exactly what to test.
Stage 2 — vulnerability checks (nuclei). Against the services we found, we run thousands of community-maintained templates that look for known CVEs, misconfigurations, exposed admin panels, default credentials and weak encryption — the same kinds of checks a tester would run, automated and consistent. We deliberately skip the informational hygiene items here; those are what the passive security posture check is for.
Why it's not instant. Each template is a real network request, sent at a deliberately measured rate so we don't hammer your server — and there are a lot of them. If a stage runs long we keep the partial results rather than give up, and mark them as partial, then translate every finding into plain language and map it to security frameworks before showing you the report.
What it can't tell you. It is not a full web-application penetration test: it won't find custom flaws in your own application's code, like SQL injection or cross-site scripting in your own forms, which need a hands-on app test. These tools find known issues, not unknown ones — so “no findings” means “nothing matched these checks,” not “your site is secure.” And if your site sits behind a CDN or cloud host, an external scan mostly sees that provider's edge, not your origin server.
Next you'll get a private link and a quick way to prove the domain is yours. Keep that link — it's how you come back to your report.