These free website security scanners check five externally observable parts of your attack surface: exposed subdomains, certificate health, DNS hardening, HTTP response headers, and content-security policy.
Each one uses public data or ordinary direct requests to the target’s own public endpoints, so it is safe to run against your own assets, a vendor you are evaluating, or an acquisition target during due diligence.
The scanners#
- Subdomain Finder — discovers up to 500 subdomains from Certificate Transparency logs and passive DNS, with no active queries to the target.
- SSL/TLS Certificate Checker — checks HTTPS availability, certificate expiry and issuer, HSTS, and DANE records to flag expired or weakly configured HTTPS.
- DNS Security Checker — audits a domain’s DNS for email-authentication and hardening records such as SPF, DMARC, and DNSSEC.
- Security Headers Checker — grades the HTTP security response headers browsers rely on, such as HSTS, X-Frame-Options, and Content-Security-Policy.
- CSP Header Generator — builds a starting Content-Security-Policy to control which scripts, styles, and frames a page is allowed to load.
How to use them#
Start with the Subdomain Finder to map what is exposed, then run the SSL/TLS and DNS checks on each host that matters.
Finish with the Security Headers Checker and CSP Generator on your main application to harden how browsers treat its responses.
For application-logic testing beyond configuration, pair these with a DAST scanner .