Buyer's guide · Website security · Checked
Free website security scanners compared: what each one checks
No single free website security scanner checks everything, so run two or three that look at different things: Mozilla's HTTP Observatory or Security Headers for security headers, Qualys SSL Labs for your HTTPS setup, and Sucuri SiteCheck for known malware and blacklisting. All are free and need only your URL. They check configuration you can see from outside. None of them logs in, reads your database rules or tests whether one user can see another user's data, which is where apps built with AI tools most often leak. Mozilla says it plainly in its own FAQ: a top grade does not mean a site is secure.
Disclosure: ChikuOS sells some of the options below, and they're labelled "ChikuOS". No vendor paid to be listed or placed, and we earn no commission or affiliate fee from any link on this page. Prices and features of other products are as listed on their own sites on 18 October 2026; follow the links to check current terms.
Free website security scanners compared (as described by each vendor)
How we chose and ordered these: Free scans you can run on any public URL come first, then free tools with paid upgrades, then active scanners you should only run on sites you own, then our paid review. What each tool checks is as its vendor describes it; we haven't benchmarked them against each other. How we compare.
| Scanner | What it checks | Price | What it doesn't check | Good fit when |
|---|---|---|---|---|
| Mozilla HTTP Observatory | HTTP security headers and related configuration, with a grade and advice | Free | Your app's logic, data access or code | A first look at headers, with explanations |
| Security Headers | Which HTTP response security headers your site sends | Free scan | Anything beyond headers | A quick second opinion on headers |
| Qualys SSL Labs Server Test | Deep analysis of your HTTPS (TLS) configuration | Free | Your app itself | Checking certificates and TLS settings |
| Sucuri SiteCheck | Known malware, viruses and blacklisting status | Free | Problems that aren't known malware or listed issues | You suspect a hacked site or a blacklist warning |
| ImmuniWeb Website Security Test | Security, privacy and encryption checks, with a free PDF report | Free | Logged-in pages and your database | You want a written summary to share |
| Pentest-Tools Website Scanner | Light free scan; paid scans look for SQL injection, XSS and 75+ other issues | Light scan free; AppScan from $140/month (5 assets) | Business logic and per-user access | A team that wants scheduled scanning |
| ZAP (Zed Attack Proxy) | Open-source scanner that actively probes pages and forms | Free, open source | Nothing is out of scope technically, so it can harm a live site. Only scan sites you own or are authorised to test | A developer testing their own app before launch |
| ChikuOS AI Site Audit | A developer reviews your live site from outside: security headers, exposed keys in your JavaScript, Supabase RLS from the public anon key, server-side auth, speed and SEO | $49, 24 hours | Your full codebase; it isn't a penetration test | Your site was built with an AI tool and you want findings ranked and explained |
Which one should you run?
- Any website: HTTP Observatory (or Security Headers) plus SSL Labs. Together they take a few minutes and cover the configuration most sites get wrong.
- A WordPress or older site you think was hacked: Sucuri SiteCheck looks for known malware and blacklisting.
- You're a developer testing your own app: ZAP is free and thorough, but it actively sends attack-style requests, so run it on your own staging site first.
- Your app was built with Lovable, Bolt, v0 or Cursor and stores user data: header and TLS scanners won't see database leaks. Use a scanner made for these apps (see vibe-coded app scanners compared) or a human review such as our $49 audit.
What a good grade does and doesn't mean
Header and TLS scanners grade things they can see in your server's responses: whether you send headers such as Content-Security-Policy and Strict-Transport-Security, and how HTTPS is set up. Those matter, and they're quick to fix. But a site can score an A+ and still let anyone read its database, if the database rules are wrong. Mozilla's own FAQ says an A+ grade doesn't mean a site is secure. Treat a good grade as "the basics are in place", not "nothing is wrong". If a scanner flags missing headers, our step-by-step fixes for HSTS missing and Content Security Policy missing start with a read-only check.
Scan only sites you own
The passive scanners in this table (Observatory, Security Headers, SSL Labs, SiteCheck) only look at what any visitor sees, so running them on a public URL is normal. Active scanners such as ZAP and paid vulnerability scanners send requests designed to trigger bugs. Only point them at sites you own or have written permission to test. Our own checks are passive and owner-authorised only.
FAQ
What is the best free website security scanner?
There isn't one that covers everything. Mozilla's HTTP Observatory or Security Headers for headers, Qualys SSL Labs for HTTPS, and Sucuri SiteCheck for known malware together cover the main free checks. All are free and only need your URL.
Is my website secure if it gets an A+ grade?
Not necessarily. Header and TLS graders only see configuration in your server's responses. Mozilla's own FAQ says an A+ doesn't mean a site is secure. Database rules, login handling and per-user access need different checks.
Can a free scanner find leaks in a Supabase or Lovable app?
General website scanners don't test database access rules. Use a scanner built for Supabase or AI-built apps, or a human review, to check whether tables can be read with the public anon key.
Is it legal to scan any website?
Passive scanners that read what any visitor sees are widely used on public sites. Active scanners such as ZAP send attack-style requests, so only use them on sites you own or are authorised to test.
How much does a website security scan cost?
The scanners in this guide are free for a basic scan; Pentest-Tools' paid AppScan starts at $140 a month for 5 assets, and our one-off human-reviewed audit is $49, as listed on each vendor's site on 18 October 2026.
How this guide was made: researched and drafted with AI assistance, then every price and claim was checked against the linked source on 18 October 2026. Editorial responsibility: ChikuOS. Spotted something out of date? Email hello@chikuos.com and we'll correct it.