Know your exposure
before attackers do
Check security headers, TLS, cookies, DNS and email records, exposed files and leaked secrets from outside your site. Every finding is ranked by severity and comes with a fix. Nothing to install.
0
Critical
1
High
3
Medium
2
Low
AI assessment: Missing Content-Security-Policy header exposes the site to XSS. Cookie flags and HSTS are configured correctly.
Security Scan is one of six Scanverra tools. One subscription covers all of them.
See all six toolsWhat we check
The full security surface of a website: headers, TLS, and beyond.
Security headers
Content-Security-Policy, X-Frame-Options, HSTS, Referrer-Policy, Permissions-Policy: every header that keeps your users safe.
TLS / HTTPS analysis
Certificate validity, expiry date, protocol versions (TLS 1.2/1.3), cipher suites, and HSTS preload status.
Vulnerability signals
Exposed server banners, outdated software version headers, open redirect patterns, and mixed content warnings.
AI risk explanation
Every finding is explained in plain English with a severity rating and concrete steps to resolve it.
How it works
No install. No agent. Results in seconds.
Enter any URL
Paste a URL: we scan the live response headers, TLS handshake, and page content without touching your infrastructure.
Deep header analysis
We check every response header against the OWASP recommended security configuration baseline.
Prioritised findings
Results are sorted by severity (critical issues first) with fix instructions tailored to your specific stack.
Full check list
27 security signals checked on every scan.
Pairs well with
Each Scanverra tool covers one angle. These two cover the next ones.
One subscription
All six tools on one plan
- Free: 5 Security Scan scans a month, no card.
- Pro: unlimited Security Scan scans, plus unlimited scans on the other five tools. Billed monthly, cancel anytime.
Related reading
Website Security Headers Explained: The Complete Checklist
CSP, HSTS, X-Frame-Options, and every other HTTP security header your site should ship - with copy-pasteable examples.
What Is CSRF? A Practical Guide to Cross-Site Request Forgery
How a malicious page can make a logged-in user's own browser perform actions they never intended - and the tokens, cookie flags, and headers that actually stop it.
SSL/TLS Certificate Errors Explained: A Troubleshooting Guide
Expired certs, name mismatches, incomplete chains, and mixed content warnings - what each browser error actually means and how to fix it.
Website Audit
Performance, SEO & accessibility
Browser Audit
Broken links, JS errors & forms
Repo Scanner
Code quality & dependency health
Find your vulnerabilities now
Headers, TLS, and vulnerability signals checked against industry standards, no agent required.
Start security scan