Website security scanner
Is your website actually secure?
Paste any website address. SiteGuard runs 39 security checks against the public things an attacker can see — headers, certificates, exposed files — and shows you exactly what to fix.
Start a scan
$ siteguard scan --target … probing 39 checks, about 30 seconds
VAPT mode — full scan + active vulnerability tests
Runs the full 39-check passive scan above, plus 9 active, non-destructive tests that probe how your site handles hostile input — reflected input, database error leaks, open redirects, leftover backup files, risky HTTP methods, verbose error pages, path traversal, template injection, and Host header injection. Detection only: nothing is written, deleted, or brute-forced.
Coverage
39 checks in every scan
Each scan probes the headers, transport security, and exposed files of your site — plus the launch risks that cost AI-built sites real money: a public database, leaked admin keys, missing image descriptions, uncached files, text-message signups without consent, trackers with no cookie consent, and missing or copy-paste privacy & terms pages. Every report also maps your results against the OWASP Top 10 — honestly marking what can and can't be tested from outside.