Free, passive, no sign-up

See your website the way a hacker sees it.

A free two-minute report on what your site shows to anyone on the internet, in plain words. No account needed.

We email you the report link. An address at your own domain also unlocks the extended check.

One email to confirm the address; it carries the code when you chose the extended check. You can also choose to get an alert when a big vulnerability might affect you.

We check your home page and a short list of well-known public files.

How it works

  1. 1

    Enter your address

    Confirm that the site is yours or that you are allowed to check it. Add an email at your own domain and you can also run the extended check: subdomains, more pages, WordPress plugins.

  2. 2

    We look from the outside

    In about two minutes we check your security headers, certificate, email records, exposed files and the software your site runs on.

  3. 3

    Read it and pass it on

    The report opens with a score and the three things to fix first. It ends with emails to your developer and host that say what to ask for and how to tell it is done.

A real report, as it came out

This is the report Scanylo produced for its own site, scanylo.com, on 26 October 2026. The screenshots are cropped, but the content is exactly what the scanner wrote, grade included.

  1. 1

    Score and summary

    The report opens with a score from 0 to 100, a grade from A to F and a short summary of what matters most.

    Report header for scanylo.com: score 67 out of 100, grade C, with a short summary naming the most important issue.
  2. 2

    What anyone can see

    Before any finding, a map of what is public: the addresses we saw, the certificate, the technology, outside scripts and email protection.

    The section What is visible from the outside, with cards for addresses, technology, outside services and email protection.
  3. 3

    Each finding in plain words

    What the problem is, why it matters and what to ask for. Each one is marked Confirmed, Potential or Unknown, and the technical detail is one click away.

    A finding card titled Your site's cookies can travel over an insecure connection, marked Confirmed.
  4. 4

    Emails for the people who fix it

    Findings are sorted by who can fix them, with one ready-to-send email each for your developer, your hosting company and your domain provider.

    What to ask your developer and host
    Three ready-to-send emails: to the website developer with four items, to the hosting company with two, and to the domain provider with one.
  5. 5

    Every request we made

    The report ends with each request, DNS lookup and certificate check the scanner made, with the answer and the time it took.

    The start of the request list: GET requests for the home page and well-known files, DNS lookups, each with its answer and time.

Your own report takes about two minutes.

Check my website

Big vulnerability in the news?

When a major vulnerability makes the news, we publish a check page for it within a day. We never call your site vulnerable from a version number alone: hosting companies often fix problems without changing it. An old number means your site may be affected and you should ask your host; a hidden one means we cannot tell.

See the current check

Questions people ask

Is this really free?

Yes. The check and the report are free and need no account. A detailed fix plan for your site is optional and costs USD 19 once.

Can you check deeper?

Yes, for free. Enter an email address at your own domain with the check, or on your report page, and confirm the 6-digit code we send. The extended check then also covers your subdomains, up to 30 pages, the versions of your WordPress plugins and a longer list of well-known files. It is still passive: it reads what any visitor could, and never tries to log in or send attack payloads.

I am not technical. What do I actually do with the report?

Send the emails at the end of the report. There is one each for your website developer, your hosting company and whoever manages your domain and email. Each item carries the technical details, so you do not have to explain them yourself.

Is it safe to scan my site?

Yes. We request public pages, the script files they load and a short, fixed list of well-known files, at most four at a time, and every request carries our name. The report lists each request we made.

Is this a penetration test?

No. It is an outside-in check of what is publicly visible. It cannot find problems that need a login or that sit behind the surface.

Will it say my site is vulnerable?

Not from a version number alone. Many hosting companies fix security problems without changing the version number your site shows, so an old number only means someone should check. The report marks it Potential and tells you what to ask your host. Confirmed is for what the check saw itself, such as a settings file anyone can download.

Can I check someone else's site?

Only if you own it or are authorised to check it, for example under a maintenance contract. You confirm that before every check.

What do you keep?

Raw responses are deleted after 7 days and findings after 90 days. Details are in our privacy policy.