Comprehensive Scanning
SQL Injection, XSS, CSRF, security headers, SSL/TLS, and coverage by depth (~40 Quick through 140+ Comprehensive).
Website Security Scan — Free Tools & Full Scans
Identify. Secure. Vulnify.
Free website security scan for SSL, headers, and DNS — no signup. Full OWASP scans for SQL injection, XSS, and Top 10 risks need a free account with email verification.
Get actionable security reports for sites you own or are authorized to test.
Why Choose Vulnify?
Professional-grade security testing for developers, security teams, and businesses.
Professional Reports
HTML and PDF reports with severity, evidence, and remediation guidance.
Fast Results
Quick under 2 minutes, Standard around 5, Deep around 15 — pick depth by risk.
Accurate Detection
Context-aware testing with fewer false positives and clearer next steps.
Secure & Private
Workspace scans private by default, encrypted in transit, account-level access controls.
Compliance mapping
Pro+ reports can map findings to PCI DSS, HIPAA, SOC 2, GDPR, CCPA, and ISO 27001 reporting needs. This is not a certificate.
Free tools · no account
Free Security Tools
Instant checks for SSL, headers, and DNS — no signup required.
SSL Checker
Free SSL checker online — certificate validity, TLS grade, HTTPS chain, and cipher strength.
ValidityExpirationGrade A–F
Security Headers Analyzer
CSP, HSTS, X-Frame-Options, and fix-oriented guidance.
CSP / HSTSClickjackingSnippets
DNS Security Check
SPF, DKIM, DMARC, and DNSSEC posture for email and domain trust.
SPF / DKIMDMARCDNSSEC
Platform-Specific Workflows
Faster identification and clearer next steps than a generic website check.
Website Security Scanner
Account-backed OWASP scans for SQL injection, XSS, exposed paths, and misconfigurations. Public SSL, headers, and DNS tools need no signup.
Best for: pre-launch, post-deploy, recurring checks
Joomla Security Scanner
Built for extension exposure, administrator surface review, and public Joomla-specific hardening checks.
Best for: extension-heavy sites and update reviews
Shopify Security Scanner
Focused on storefront security, theme and app signals, exposed client-side risk, and safer release validation.
Best for: theme changes and app-related risk
WordPress Security Scanner
Designed for plugin and theme intelligence, public WordPress hardening, and higher-confidence component review.
Best for: plugin-heavy sites and patch verification
Popular Security Guides
Compliance, OWASP, XSS, headers, and scanner strategy.
GDPR Article 32 Technical Measures
Appropriate technical and organisational measures explained for web teams.
OWASP Top 10 2025
What changed and which categories to fix first on your next sprint.
XSS Scanner and Prevention
Find cross-site scripting with scanners, then harden encoding and CSP.
Security Headers (CSP, HSTS)
CSP, HSTS, and X-Frame-Options with a verification checklist.
What We Test
Coverage by scan depth: about 40 Quick checks through 140+ on Comprehensive.
Injection Attacks
- SQL Injection (56 payloads)
- Cross-Site Scripting (XSS) (80 payloads)
- Command Injection (44 payloads)
- Path Traversal / LFI (50 payloads)
- Server-Side Request Forgery (SSRF) (40 payloads)
Security Headers
- Content-Security-Policy (CSP)
- Strict-Transport-Security (HSTS)
- X-Frame-Options (Clickjacking)
- X-Content-Type-Options
- X-XSS-Protection
- Referrer-Policy
- Permissions-Policy
Cookies & Sessions
- Cookie Secure Flag
- Cookie HttpOnly Flag
- Cookie SameSite Attribute
- Session Cookie Expiration
SSL/TLS & Encryption
- SSL Certificate Validity
- TLS Protocol Version
- Certificate Expiration
- Mixed Content Detection
Information Disclosure
- Exposed Version Control (.git, .svn)
- Configuration Files (.env, web.config)
- Backup Files (.sql, .zip, .tar.gz)
- Admin Panels (/admin, /wp-admin)
- Server Version Disclosure
- robots.txt & sitemap.xml Analysis
Server Configuration
- HTTP Methods (PUT, DELETE, TRACE)
- DNS Resolution & Load Balancing
- Subdomain Enumeration
- API Endpoint Discovery
- CORS Configuration
Coverage by depth — Quick (~40), Standard (~80), Deep (~120), Comprehensive (~140+). Tests use context-aware analysis to reduce false positives and return actionable remediation steps.
Simple, Transparent Pricing
Subscribe monthly or yearly — or buy credits as you go.
Free
$0
forever
10 credits10 signup bonus credits
- Basic security reports
- Access to the dashboard and scan history
- Free public tools
- Starter credits included (one Quick scan)
MOST POPULAR
Pro
$39
per month
100 credits100 credits per month
- Rollover up to 200 credits
- Everything in Free
- Scheduled scans (up to 3)
- Email notifications and alerts
Team
$79
per month
250 credits250 credits per month
- Rollover up to 500 credits
- Everything in Pro
- Team workspaces (up to 10 seats)
- API keys (up to 5)
- White-label reporting controls
Frequently Asked Questions
Everything you need to know about website security scanning.
Vulnify is a free online website security platform at vulnify.app. It offers public security tools (SSL, headers, DNS, CSP) with no signup, plus full vulnerability scans for SQL injection, XSS, and OWASP Top 10 risks from a free account. Vulnify.app is the official product — not affiliated with unrelated vulnify.* domains.
Ready to Secure Your Website?
Public tools take seconds. A full scan needs Get Started, email verification, and starter credits — no credit card.