Online · passive scan of your website

We know where your site has weak spots.

Vulscan checks your domain in seconds and shows where an attacker would start. No signup, no install, free.

Passive scanNo signup20+ checks
Enter a domainhttps://
TRY
Scanned domains feed our public counter · no cookies, no IPs. More
What we've seen so far
We map the web continuously with our own scans, and the numbers grow every day. This summary is updated once a day.
—
Domains tracked
across TLDs
—
Passively scanned
full report
—
Owners we notified
we told them what we found
What we check

Over twenty checks your IT should run but usually doesn't.

We go through your domain the way every attacker starts. If we find something, we explain it in plain language and tell you how to fix it.

01
HTTPS & TLS
Certificate validity and chain, protocol version, HTTP to HTTPS redirect, HSTS preload.
02
Security headers
CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy.
03
DNS records
SPF, DMARC, CAA. Email spoofing defence and CA authorisation.
04
Cookies & privacy
Secure, HttpOnly, SameSite attributes on session cookies. GDPR + ePrivacy alignment.
05
Exposed paths
/.git, /.env, /.htpasswd, phpinfo, /.DS_Store and exposed directory listings.
06
WordPress hygiene
Version detection, xmlrpc, user enumeration, exposed debug.log, open wp-admin.
07
Hosting diagnostics
Reverse DNS and hosting provider detection. Context for other checks.
08
security.txt & contact
Presence of the RFC 9116 contact file for vulnerability reports.
09
Info disclosure
Server and X-Powered-By headers: exact technology versions leaking in responses.
Specialised audits

Audits tailored to your stack

A general scan isn't enough for some sites. We have four variants with checks for a specific type of site.

For any website

Site audit

An audit of any domain. Over 20 checks: TLS, headers, DNS, exposed files, WordPress.

Run
For WordPress

WordPress audit

8 WordPress checks, such as xmlrpc, debug.log, user enumeration and an exposed wp-config.

Run
For e-shops

E-shop audit

Cookies, GDPR, payment redirect, mixed content. WooCommerce, Magento, PrestaShop and custom builds.

Run
For devs & IT

TLS + headers test

A detailed test of TLS, HSTS, CSP and 18 more security headers.

Run

What happens if you ignore it

  • 1
    Customer data leak. A GDPR fine can reach 4% of revenue. Reputation damage lasts years.
  • 2
    Domain abused for spam. With weak SPF and DMARC, anyone can send email in your name.
  • 3
    Search penalty. Google pushes HTTP sites down and warns users away.
  • 4
    Site takeover. An outdated WordPress plugin can give an attacker admin access within minutes.

Why fix it now

  • A
    Fixes are cheap. Most headers take 15 minutes. An incident takes weeks.
  • B
    We're on your side. The scan and the report are free. If you're stuck, write to us and we'll help.
  • C
    EU + NIS2 ready. Built with NIS2 in mind. Our advice is written for small and mid-sized European businesses.
  • D
    Continuous watch. Watch checks your site every day and alerts you when something changes.

Find out where your weak spot is. It takes a few seconds.

The scan is passive and doesn't touch your site. No signup.