Tool · Nmap + OWASP ZAP
Website vulnerability scanner
Free Basic Scan: enter your domain or URL. Nmap checks the server your website runs on from the internet: open ports, the software and versions answering, weak SSL/TLS settings, and versions with known vulnerabilities. Every finding is rated and comes with a fix.
Deep Scan, $59: adds OWASP ZAP, which crawls your website and actively tests it for missing security headers, insecure cookies, missing anti-CSRF tokens, directory listing and common web vulnerabilities, plus a check of all 65,535 ports.
Two layers: the server and the site
A website can be attacked in two places. The server underneath it: its operating system, web server software, encryption settings and any other services running on the same machine. And the site itself: its pages, forms, cookies and headers.
Many breaches of small business websites start at the server layer: an outdated Apache or OpenSSH, an old TLS setting, or a database or Remote Desktop port left open on the same machine. That is what the free scan covers. The site layer needs a crawler that understands web applications, which is what OWASP ZAP does in the Deep Scan.
What the free scan finds on your web server
- Weak encryption. Old SSL/TLS versions, weak ciphers, and known flaws such as Heartbleed and POODLE. Guide
- Outdated server software. Detected versions of programs like Apache, nginx and OpenSSH are matched against public CVE lists. Guide
- Other doors on the same machine. Databases, Remote Desktop, FTP and other services that should not face the internet. Guide
- Some web-level issues. Nmap's vulnerability scripts include web checks, so the free scan can also flag things like exposed admin paths or forms without anti-CSRF tokens on the pages it reaches.
What the Deep Scan adds: an OWASP ZAP test
OWASP ZAP is a widely used open-source web application scanner. In the Deep Scan it crawls your site, then actively tests the pages and forms it finds. Typical findings:
- Missing Content-Security-Policy and other security headers
- Missing HSTS header
- Cookies without HttpOnly, Secure or SameSite
- Forms without anti-CSRF tokens
- Directory listing and server version leaks
- Common web vulnerabilities that ZAP's active rules test for
An active test submits test input to your pages and forms. Run it on a site you own, ideally outside your busiest hours.
Free scan or Deep Scan
Basic Scan Free
- Server checks with Nmap
- SSL/TLS weaknesses
- Outdated software with known CVEs
- 1,000 most common ports
Deep Scan $59
- Everything in the Basic Scan
- OWASP ZAP crawl and active test
- Headers, cookies, forms, web flaws
- All 65,535 ports, OS fingerprinting
Common questions
Is the free scan a full website vulnerability test?
No, and we'd rather say so up front. It checks the server your site runs on, which is where many real breaches start. Testing the pages, forms and cookies is the Deep Scan's OWASP ZAP test.
Will the scan slow down or break my site?
The free scan only connects and reads responses. ZAP's active test sends more requests and submits test input, so on a fragile site it can create test entries or extra load. That's why it should only be run on sites you own.
My site is on Shopify, Wix or Squarespace. Is it worth scanning?
The platform runs and patches the server, so there is less for you to fix there. Scans are most useful for sites you or your provider host yourselves, such as WordPress on your own hosting, or a custom app.
Can I scan someone else's website?
Only with their written permission. You confirm authorization before each scan, and the confirmation is recorded.