Website Vulnerability Scanner
Find what attackers can see on your website
Enter a URL. AI Inspector Lab fingerprints the technologies and versions your site discloses, checks HTTP security headers, HTTPS, cookies, CORS, DNS and email authentication, and matches detected software against known vulnerabilities - without sending a single attack payload.
What the inspector checks
Security headers & TLS
Strict-Transport-Security, Content-Security-Policy quality, framing protection, nosniff, Referrer-Policy, HTTP → HTTPS redirect, mixed content and insecure forms.
Cookies & CORS
Secure, HttpOnly and SameSite on every cookie (names only, never values), and whether the site reflects arbitrary origins with credentials.
Technologies & CVEs
Servers, CMS, frameworks and JavaScript libraries with disclosed versions, matched against NVD CPE ranges and OSV advisories - labelled as potential until confirmed.
DNS & email
SPF, DMARC, DKIM at common selectors, MTA-STS, CAA and DNSSEC, read through DNS-over-HTTPS.
Source maps & security.txt
Publicly downloadable JavaScript source maps and an RFC 9116 security.txt.
Verified-domain checks
After you verify ownership, safe probes confirm exposed .git, .env, backups, database dumps and debug endpoints by content signature - contents are never stored.
Who uses it
- Developers hardening a launch
- Agencies auditing client sites
- Security teams tracking an external attack surface
- Founders answering a customer security questionnaire
Website Vulnerability Scanner FAQ
Is this scan legal to run on any website?
The default scan only makes the requests a browser or search engine makes. Active, safe validation checks run only on domains you have verified you control.
Will the scan affect my site's performance?
No. It requests a handful of pages and their scripts with strict timeouts, size limits and low concurrency.
Does a CVE match mean I've been hacked?
No. It means the version your site reports is inside an advisory's affected range. Confirm the installed version and apply the fix; the report lists sources and fixed versions on Pro and Team.
Other detectors
Try the Website Vulnerability Scanner for free
Check text, public websites and GitHub repositories for free - no account needed. Go Pro for private document, image and code inspections, Compare and the API.