Joomla
Extension-aware guidance, public-surface validation, and rerun-ready fixes.
Best for: extension / template exposure reviews
Free tools — no account required
Free Website Security Tools
Free online security tools for developers and security teams — SSL, DNS email security, headers, CSP, and vulnerability scanning. No sign-up required, no credit card needed. Get instant results and actionable recommendations.
Run All Tools on One Domain
Run all free checks in one pass and generate a consolidated report in the same style as Vulnify scan reports.
Start here
Top Free Security Tools
Start with the highest-demand checks — vulnerability scanning, TLS, headers, CSP, and DNS email security — then explore payloads and guides below.
Popular
Most Popular Security Pages
Free tools and guides with the highest search demand — start here for payloads, scanning, SSL, and CSP checks.
XSS Payloads List
Copy-paste XSS test strings for reflected, stored, and DOM-based testing.
SQL Injection Payloads
Copy-paste SQLi payloads for boolean, error, time-based, and union tests.
Website Vulnerability Scanner
Free scanner guide for SQL injection, XSS, exposed paths, and misconfigurations.
Free SSL Checker
Grade TLS certificates, expiry, chain trust, and protocol posture online.
Free CSP Checker
Test Content-Security-Policy headers and unsafe-inline risks instantly.
CORS Checker for Security
Test Access-Control-Allow-Origin headers and cross-origin policy risks.
Platform pathways
Stack-Aware Workflows
Faster identification and clearer next steps than a generic website check.
Shopify
Merchant-focused storefront guidance with mode-aware reporting and rerun steps.
Best for: storefront headers, cookies, and scripts
WordPress
Component-intelligence workflow guidance with fast remediation and verification.
Best for: plugin / theme footprint checks
Full catalog
All Free Tools
Every free checker with full descriptions and capability details — same SEO content, clearer layout.
SSL Certificate Checker
Verify your SSL/TLS certificate validity, expiration date, and security configuration. Get an instant grade and recommendations.
Certificate + chain trust diagnosticsProtocol/cipher risk evidenceExpiry and renewal prioritiesActionable hardening recommendationsExecutive-ready grade + summary
Security Headers Analyzer
Analyze your HTTP security headers to protect against XSS, clickjacking, and other common attacks. Get copy-paste fixes.
Directive-level header scoringMissing/weak policy detectionRoute-aware security header evidenceExploitability-focused prioritizationCopy-paste fix templates
DNS Security Check
Check your email security with SPF, DKIM, DMARC, and DNSSEC verification. Prevent email spoofing and phishing.
SPF/DKIM/DMARC maturity analysisSpoofing and delivery risk signalsSelector/policy validation evidenceDNS and MX resilience indicatorsRemediation playbook with next actions
Joomla Stack Checker
Run a Joomla-aware profile for extension, template, and public-surface risk with remediation-first prioritization and bounded deeper evidence.
Joomla signal confidenceExtension and template evidence (comprehensive)Public API/admin/install surface validation (comprehensive)Fix-first remediation roadmap
WordPress Stack Checker
Run a WordPress-aware profile for core/plugin/theme footprint exposure, browser hardening controls, route-level evidence, and remediation-first prioritization.
WordPress footprint confidenceRoute and endpoint evidence (comprehensive)Plugin/theme component intelligence (comprehensive)Fix-first remediation roadmap
Shopify Storefront Checker
Run a Shopify-aware storefront security profile for transport, headers, cookies, scripts, route-level evidence, and merchant-controlled exposure risks.
Shopify signal confidenceRoute and endpoint evidence (comprehensive)Third-party script risk indicatorsStorefront remediation roadmap
CSP Checker
Validate Content-Security-Policy configuration and identify weak directives before attackers can abuse them.
Directive-level risk scoringBypass pattern detectionStack-specific remediation
HSTS Checker
Check Strict-Transport-Security configuration, preload readiness, and transport hardening posture.
Policy strength validationPreload readiness checksTransport hardening actions
Cookie Security Checker
Review cookie flags including Secure, HttpOnly, and SameSite to improve session hardening.
Cookie inventory evidenceSecure/HttpOnly/SameSite gapsSession hardening playbook
HTTP Methods Checker
Detect exposed HTTP methods and risky verb configurations across website endpoints.
Multi-endpoint method mappingDangerous verb exposure riskLeast-privilege method policy
CORS Checker
Inspect CORS headers, wildcard-origin exposure, and credentialed cross-origin risks.
Origin reflection detectionCredentialed CORS risk analysisAllowlist-first policy fixes
Exposed Paths Checker
Safely check for publicly reachable sensitive paths, admin locations, and likely exposure indicators.
Confidence-scored exposure findingsSensitive endpoint evidenceImmediate containment guidance
security.txt Checker
Verify responsible disclosure policy publication via security.txt and validate formatting freshness.
RFC-style field validationStale policy detectionDisclosure policy fix template
Redirect Chain Checker
Audit redirect hops, loops, downgrade issues, and canonical path efficiency.
Hop-by-hop redirect evidenceLoop and downgrade risk detectionCanonical path optimization
Open Redirect Checker
Probe common redirect parameters for unvalidated external destinations using safe example.com payloads.
Parameter abuse probingHTML link/form discoveryBounded safe-active GET checks
Robots and Sitemap Checker
Validate crawlability baseline with robots.txt and sitemap checks, conflict detection, and indexability guidance.
Crawl-policy conflict checksSitemap validity signalsIndexability remediation plan
Mixed Content Checker
Find HTTP asset references on HTTPS pages and prioritize mixed-content remediation.
Active/passive mixed-content splitInsecure asset evidenceHTTPS migration priorities
TLS Deep Analysis
Inspect protocol support, certificate lifecycle, cipher posture, and chain trust in detail.
Protocol and cipher risk analysisCertificate lifecycle alertsChain trust diagnostics
Email Security Checker
Review SPF, DKIM, and DMARC maturity with spoofing exposure and deliverability guidance.
SPF, DKIM, and DMARC maturity scoringSpoofing exposure indicatorsDeliverability and enforcement actions
Website Technology Fingerprint
Discover exposed technology fingerprints, disclosure headers, and stack hardening opportunities.
Multi-signal stack fingerprintingDisclosure risk prioritizationPlatform hardening checklist
Passive Subdomain Discovery
Run low-noise passive subdomain discovery to understand attack surface expansion opportunities.
A, AAAA, and CNAME discovery signalsConfidence-scored asset mappingAttack-surface prioritization
JS Library Vulnerability Checker
Detect JavaScript libraries, identify outdated components, and review safer upgrade priorities.
Library and version evidence extractionOutdated component risk flagsSafer upgrade recommendations
DNS Record Lookup
Inspect A, AAAA, MX, NS, TXT, SOA, and CAA records with redundancy and misconfiguration analysis.
Full record inventory in one passName server redundancy checksSPF, DMARC, and CAA presence signals
CAA Record Analyzer
Review which certificate authorities may issue for your domain, including inherited parent-domain policy.
Effective CAA policy resolutionParent-domain inheritance walkissue, issuewild, and iodef review
WHOIS / RDAP Domain Lookup
Check domain registration, expiration date, registrar locks, and DNSSEC status using live registry RDAP data.
Expiration and renewal risk alertsTransfer lock and hold status reviewDNSSEC delegation verification
Password Strength Checker
Test password strength with entropy analysis, pattern detection, and crack-time estimates. Runs entirely in your browser.
Entropy and crack-time estimatesCommon pattern and dictionary detectionNothing leaves your browser
Hash Generator
Generate MD5, SHA-1, SHA-256, SHA-384, and SHA-512 hashes from text. Runs entirely in your browser.
Five digest algorithms in one passCopy-ready hex outputNothing leaves your browser
Hash Verifier
Identify hash types and verify whether candidate text matches a digest. Runs entirely in your browser.
Algorithm detection from digest lengthPlaintext match verificationNothing leaves your browser
Permissions-Policy Analyzer
Review Permissions-Policy and legacy Feature-Policy headers for overly permissive browser feature access.
Sensitive feature restriction reviewWildcard directive detectionStack-specific remediation guidance
DNSBL Blacklist Checker
Check whether a domain or IP appears on major email and reputation blacklists using public DNSBL zones.
Spamhaus, SpamCop, and UCEPROTECT lookupsIPv4 resolution for domain targetsDeliverability and reputation signals
WAF / CDN Detector
Fingerprint common WAF and CDN providers from response headers and edge behavior.
Cloudflare, Akamai, Fastly, and Sucuri detectionServer banner disclosure reviewEdge infrastructure mapping
Subdomain Takeover Scanner
Find CNAME records that point at unclaimed SaaS or hosting services and may be vulnerable to takeover.
CNAME fingerprint matchingLive response verificationCommon SaaS provider coverage
JWT / Token Decoder
Decode JWT headers and payloads, inspect claims, and encode or decode Base64 locally in your browser.
JWT header and payload inspectionUnsafe algorithm warningsBase64 encode and decode utilities
Learn How to Secure Your Website
Explore our comprehensive security guides with step-by-step tutorials and copy-paste configurations.
Guides
From the Security Blog
Long-form guides that match what teams search for before running a vulnerability scan.
How to Scan for Vulnerabilities
Step-by-step guide before you run your first full website scan.
SAST vs DAST vs SCA
Compare scanner types and see when free DAST is enough to start.
Cookie Security Explained
HttpOnly, Secure, and SameSite flags with verification steps.
GDPR Article 32 for Web Teams
Appropriate technical measures, encryption, and evidence auditors expect.
OWASP Top 10 2025 Explained
Updated risk categories and remediation priorities for modern apps.
XSS Scanner Guide
Detection workflow plus CSP and encoding defenses that stick.
Security Headers Explained
CSP, HSTS, and X-Frame-Options with live verification steps.
SSRF Explained (2026)
Blind SSRF paths, cloud metadata risk, and outbound controls.
Best Free Scanners 2026
Compare free website security scanners before you upgrade depth.
Topics
Browse by Topic
Explore the full Phase 1 content cluster covering scanner strategy, SQL injection, XSS, exposure issues, redirects, and infrastructure review.
Common Website Vulnerabilities
Top-level hub for injection, exposure, redirect, and configuration risks.
Website Vulnerability Scanner
Free scanner guide for SQL injection, XSS, exposed paths, and misconfigurations.
OWASP Top 10 2025 Hub
Map each OWASP category to free scanners, payloads, and fix guides.
SAST vs DAST vs SCA Comparison
Interactive picker — which scanner type fits your team first.
SQL Injection Detection
Detection workflow, validation methods, and safe evidence collection for SQLi.
SQL Injection Payloads List
Copy-paste SQLi test strings for boolean, error, time-based, and union testing.
XSS Detection
How to detect reflected, stored, and DOM-based XSS in real workflows.
XSS Payloads List
Copy-paste XSS test strings for reflected, stored, and DOM-based testing.
Exposed .git Vulnerability
Detect repository exposure, handle incident response, and harden releases.
Hidden Files Exposure
Review .env, backup files, admin URLs, and other exposed sensitive paths.
Open Redirect Vulnerability
Examples, bypass patterns, and practical redirect validation fixes.
DNS Misconfiguration
SPF, DKIM, and DMARC review guidance for spoofing resistance and delivery.
Subdomain Discovery
Passive discovery, prioritization, and continuous attack-surface monitoring.
FAQ
Tools Hub FAQ
Answers about free security tools, no-signup access, DNS email checks, and how Vulnify fits your workflow.
Vulnify offers free online security tools with no signup: SSL/TLS checker, security headers analyzer, DNS email security check (SPF, DKIM, DMARC), CSP checker, CORS checker, HSTS checker, XSS and SQL injection payload libraries, and a website vulnerability scanner guide. Run quick checks instantly from your browser.
Want a Complete Security Assessment?
Our free tools provide quick checks. For a comprehensive vulnerability scan including XSS, SQL injection, CSRF, and 50+ security tests, try our full scanner.
50+Security Tests
5minAvg. Scan Time
PDFDetailed Reports
Live
Live Scan Activity
Real-time security testing activity across Vulnify free tools and scans.