Site audit · over 20 checks · no signup

Find out where your site has weaknesses. In 30 seconds.

Enter a domain and we run over 20 checks: TLS, headers, exposed files, DNS, WordPress. In half a minute you'll see the results. You can email yourself a PDF report with the steps to fix them.

Passive scan · no signup · results in 30 seconds

https://

Scan takes 30 seconds. You can request the PDF report with a button on the results page.

How it works

3 steps · 30 seconds

Enter your domain

No signup, just the site address. We ask for an email only when you request the PDF report.

We check over 20 things

Passively. TLS, security headers, DNS (SPF/DMARC), exposed files, CMS versions.

Results and PDF report

You see the most serious findings on the site right away. We email you the full PDF report for free. In it, every finding has an explanation, its impact and a step to fix it.

What we look for

We go through your domain the way every attacker starts. If we find something, we explain it in plain language.

Headerscritical

Missing Content-Security-Policy

Without CSP, an XSS attack can run someone else's code in your customers' browsers.

Content-Security-Policy: (not present)

Exposedcritical

Publicly accessible /.git

An attacker can download your entire source code. It may contain database credentials or API keys.

GET /.git/HEAD → 200 OK

TLSwarning

TLS 1.0 still enabled

An outdated protocol with known weaknesses. It also violates PCI-DSS.

openssl s_client -tls1 → handshake OK

DNSwarning

DMARC policy = none

Anyone can send emails as your domain. Spam reaches your clients.

_dmarc: v=DMARC1; p=none

WordPresswarning

WordPress 6.2 (outdated)

4 vulnerabilities have been patched since your version. Core auto-updates are probably disabled.

generator: WordPress 6.2

About Vulscan

We look for the weaknesses an attacker notices first. If we find something, we tell you what to do about it.

hello@vulscan.app LinkedIn

Passive scan

No invasive tests. We behave like an ordinary visitor, and your site won't notice the check.

European context

We know local hosting providers, CMSes and registrars, so our recommendations are specific.

Real help

If you don't understand a finding, write to us. We'll answer.

Frequently asked questions

Is the scan safe? Won't it damage the site?+

Yes. The scan is passive and behaves like an ordinary visitor. We don't try exploits, crack passwords or send attack requests. Your site won't notice the check.

What do you do with the data? Where do results go?+

You see the most serious findings on the site right away. You can email yourself the full PDF report with one click. We keep your email so we can alert you if a new serious finding appears on your domain. You can unsubscribe at any time.

What if you find a critical problem?+

You'll get a report where every problem is explained with a concrete remediation step. Most things your webmaster can handle. If not, write to us. We're happy to take a look.

Does it cost money? What's the catch?+

A one-off scan is free.

Who runs this?+

Vulscan is run by a European team with experience in penetration testing and infrastructure management. We focus on web security across the EU. We know local hosting providers, CMSes and registrars, so our recommendations are specific.

The scan takes 30 seconds. The fix usually takes 15 minutes.

Enter a domain and look at the results. With one click you can email yourself a PDF report of what needs fixing.