Website Security Scanner

Find out what
you
left
wide open.

Paste your website’s address and get an outside-in security check in about a minute: keys left in your JavaScript, missing security headers, weak cookies and CORS mistakes.

Only scan websites you own or are allowed to test.

Getting ready…

id8’s Website Security Scanner checks a website from the outside. It loads your public pages the way a visitor’s browser would and reports what anyone could see: credentials in your JavaScript, security headers you are not sending, cookies without the right flags, and API settings that trust too much. Every finding shows the proof and how to fix it.

Updated 11 October 2026 · Built by id8 Tools

Six checks

What it checks

Keys left in JavaScript

Stripe live secret keys, GitHub tokens, AWS access key IDs, Slack tokens, Supabase service-role keys and private keys. The report shows only the first and last characters.

Security headers

Content-Security-Policy, Strict-Transport-Security, protection against being framed by other sites, X-Content-Type-Options and Referrer-Policy.

Cookies

Session cookies missing Secure or HttpOnly, and SameSite=None without Secure. Only your own site’s cookies are judged, not ones set by other companies.

CORS

An API of yours that trusts the “null” origin with credentials, or is readable from any origin while taking a login.

Mixed content

Scripts and other files loaded over plain HTTP on an HTTPS site.

API surface

The endpoints your public pages call, so you can confirm each one checks who is asking.

How it works

  1. Enter your website’s address

    Paste it in and press Scan.

  2. We load it on our scanning server

    In a real browser: up to 50 pages, following only links on your own site. If your address only redirects to another website, that website is scanned instead. Scans run one at a time, so you may wait in a short queue.

  3. Findings appear as they are found

    Then the full list is ranked, worst first.

What it can’t do

  • It does not log in, so it cannot see pages behind a login.
  • It does not test whether a database or an endpoint can actually be read: it never sends a request your own pages would not send.
  • It does not load scripts from ad, analytics and tracker services, so it does not look for keys inside them.
  • It scans default ports only, and each website once every 6 hours.
  • A clean report means none of these six checks found a problem. It is not proof that a site is secure.

What we keep

The scan runs on our server, so the address you enter is sent to it. We store your IP address with the scan for up to 30 days to enforce the daily limit, and the latest findings for each website. Anyone who enters the same website within 6 hours of a scan sees those findings instead of starting a new one.

Findings never include the value of a key or a cookie.

Frequently asked questions

Is the Website Security Scanner free?

Yes. Without an account you get one scan a day. Sign up free for five a day.

What does it check?

Keys left in JavaScript, security headers, cookies, CORS, mixed content and the API endpoints your public pages call.

Does it attack or change my website?

No. It loads your public pages like a visitor’s browser and never sends a request your own pages would not send.

Where does the scan run?

On our scanning server, in a real browser.

How long does a scan take?

About a minute. Scans run one at a time, so you may wait in a short queue first.

More free tools: keep secrets out of your code with Env Vault, and tidy an API answer with JSON Surgeon.