Turn a scan into compliance evidence
A security scan is only useful if you can act on it. Every finding here is organized into a concern category and mapped to the SOC 2 and GDPR controls it's relevant to.
Run free security auditWhat the scan covers
Headers & transport
CSP, HSTS (with a live check against the browser HSTS preload list), X-Frame-Options, and TLS/certificate configuration.
Exposure
Exposed secrets, sensitive files, and admin/backup paths accidentally revealed in robots.txt.
Cookies & CORS
Missing Secure/HttpOnly cookie flags and permissive CORS configuration.
Reference mapping
Every finding tagged with a CWE identifier and an OWASP Top 10 (2021) category, plus PCI relevance where applicable.
Concern category to control mapping
| Concern | SOC 2 | GDPR |
|---|---|---|
| Secrets exposure | CC6.1, C1.1 | Art. 32 |
| Transport encryption | CC6.7 | Art. 32 |
| Access control | CC6.1 | Art. 25 |
| Injection risk | CC6.8 | Art. 32 |
| Dependency vulnerabilities | CC6.8 | Art. 32 |
| Information disclosure | C1.1 | Art. 5(1)(f) |
| Monitoring gaps | CC7.2 | Art. 33 |
| Configuration hardening | CC6.6 | Art. 25 |
How it works
From raw findings to categorized, mapped evidence.
Paste your URL
No agent install, no code access - an external scan against your live site, the same view an attacker gets.
Findings, categorized
Each issue is bucketed into a concern category (secrets, transport encryption, access control, and more) rather than left as a flat list.
Mapped to controls
Every concern category is mapped to relevant SOC 2 Trust Services Criteria and GDPR articles, as a starting point for audit evidence.
Frequently asked questions
No, and we're explicit about that in the product itself: this is a heuristic category mapping, not a certified assessment. A scanner finding is evidence relevant to a control, not proof the control is met - SOC 2 and GDPR compliance also require non-technical controls (policies, access reviews, vendor management) this scan can't evaluate. Use it as a useful starting point for gathering evidence, not a substitute for an actual audit.
The Security Headers Checker goes deep on one thing - HTTP security headers, with full CSP directive analysis and HSTS preload verification. This audit takes the broader scan (headers plus secrets, cookies, CORS, and more) and organizes it around compliance-relevant concern categories and their mapped controls.
The scan's findings map to several Common Criteria (CC6.1 Logical Access, CC6.6 Network Security Configuration, CC6.7 Transmission Confidentiality, CC6.8 Malicious Code Prevention, CC7.2 System Monitoring) and the Confidentiality criterion (C1.1) - the criteria most directly tied to what an external website scan can actually observe.
Primarily Article 32 (Security of Processing), Article 25 (Data Protection by Design), and Article 5(1)(f) (Integrity and Confidentiality) - the articles concerned with technical security measures, which is what an external scan can speak to.
Related audits
Website Audit
Run a free instant audit for performance, SEO, accessibility, and best practices.
SEO Audit
Check crawlability, metadata, structured data, and AI-agent discoverability.
Performance Audit
A full lab performance audit across desktop and mobile, with framework-aware fixes.
Accessibility Audit
See exactly which WCAG 2.1/2.2 success criteria your site fails, and why.
Website Speed Audit
How fast your site loads, in plain language - one number, no jargon.
Core Web Vitals Audit
Check LCP, CLS, and INP against Google's thresholds, lab and field.
Broken Link Checker
Crawl a page's links and find the ones that are dead before your users do.
Security Headers Checker
CSP, HSTS, and every other HTTP security header - analyzed, not just listed.
Open Graph Checker
See whether your page has the og:title, og:description, and og:image tags social platforms need.
Schema Markup Checker
Check whether your page ships JSON-LD structured data search engines and AI agents can read.
Sitemap Checker
Check whether your sitemap.xml is reachable, valid, and free of common mistakes.
Redirect Checker
Trace a URL's redirect chain and catch loops, excess hops, and HTTPS-to-HTTP downgrades.
SSL Checker
Test your SSL certificate for expiry, hostname match, chain trust, TLS version, key strength and HSTS in seconds.
Color Contrast Checker
Calculate the WCAG contrast ratio of any two colors and see AA and AAA results, with a suggested accessible color.
Website Technology Checker
Find out which CMS, framework, ecommerce platform and libraries a website is built with.
robots.txt Checker
Check syntax, sitemap lines and size limits, and test whether Googlebot or any crawler can access a URL.
Canonical Checker
Find missing, duplicate, relative or conflicting canonical tags and check that the canonical URL loads.
Hreflang Checker
Validate language codes, x-default and self-references, and confirm every alternate page links back.
Meta Tag Checker
Check title tags, meta descriptions, H1 headings, robots, viewport and Open Graph tags on any page.
HTTP Status Checker
Check up to 20 URLs at once for 200, 301, 404 and 500 responses and redirect chains.
CSP Evaluator
Check a Content-Security-Policy for unsafe-inline, unsafe-eval, wildcards, missing object-src and base-uri, from a URL or pasted policy.
Mixed Content Checker
Find http:// scripts, stylesheets, iframes and images on HTTPS pages that browsers block or warn about.
Alt Text Checker
Find images with missing, empty, file-name or overly long alt text on any page, for accessibility and image SEO.
API Key Leak Checker
Scan a website's public HTML and JavaScript for exposed API keys, tokens and secrets.
MCP Security Scanner
Find unpinned MCP servers, leaked tokens and risky agent settings in your repo.
Vibe Coding Security
Check AI-written code for secrets, injection flaws and risky dependencies.
ADA Compliance Checker
Test your site against the WCAG criteria ADA cases reference.
EAA Compliance Checker
Check your site against the WCAG basis of the European Accessibility Act.
For Agencies
Audit client sites for SEO, speed, accessibility and security on one team plan.
Related reading
Website Security Headers Explained: The Complete Checklist
CSP, HSTS, X-Frame-Options, and every other HTTP security header your site should ship - with copy-pasteable examples.
How to Implement a Content Security Policy Without Breaking Your Site
CSP is the highest-leverage security header and the easiest one to break your own site with - a safe rollout strategy using report-only mode.
Run a free security audit
Findings categorized and mapped to SOC 2 and GDPR controls.
Run free audit