securityscanner.org

How it works

One line: you prove the site is yours, the scanner looks at it from the outside, and a graded report lands in your inbox within the hour and then once a month, until you say stop. Free forever, no paid tier.

  1. Sign up with an email at your domain

    Enter your first name, your website and a work address at the same domain, for example jo@example.com for example.com. A Gmail, Outlook or Yahoo address will not work, because it proves nothing about who owns the site. Answer one question (do customers ask you for a SOC 2 report or a security questionnaire) and say what kind of business it is. Tick the box to confirm you own the site or are authorised by its owner to have it scanned, and that it belongs to a US business.

  2. Click the confirmation link

    A confirmation email arrives within a minute. Nothing is scanned until the link in it is clicked. The link works once and expires after 24 hours. If it does not arrive, check spam, then sign up again.

  3. The first report, within the hour

    The scanner runs the confirmed-email checks (the full list): read-only, at most 25 ordinary web requests, nothing changed on your site. Each check gets a grade. The overall grade is a weighted average that is held down to one letter above the worst of the four big checks (encryption, exposed files, email protection, security headers), so fixing the big things is what moves it. Every finding says what to change and how hard it is.

  4. Then once a month

    The same checks run again around the same day each month, and the report shows what changed since last time: fixed, still open, new. If something has gone to F, the subject line says so. Between scans nothing touches your site.

  5. Optional: verify the domain for the monthly crawl

    Proving you control the domain, not only a mailbox at it, unlocks the verified level: once a month the scanner crawls every page your site links to and runs passive rules on each one (cookie flags, headers, information leaks, old JavaScript libraries, forms that post over plain http). It is the same baseline scan I run for agency clients. It is still not an attack: it reads what each page sends back and changes nothing.

    Two ways to prove it. Your own token is in the first report and on your confirmation page. The ones below are examples.

    Recommended: a DNS TXT record

    Type
    TXT
    Name
    _securityscanner so the full name is _securityscanner.example.com
    Value
    securityscanner-verify=a81c0d your own token replaces a81c0d
    TTL
    3600 or your provider's default

    Where to add it: the DNS settings wherever your domain is registered or hosted (Cloudflare, GoDaddy, Namecheap, Route 53, Squarespace, your web host). DNS changes can take up to a day to spread.

    Or: a file on the site

    URL
    https://example.com/.well-known/securityscanner
    Contents
    securityscanner-verify=a81c0d one line, your own token, plain text

    The scanner checks for the record or the file every few hours and emails you once it is seen. The proof is checked again immediately before every monthly run. If it is gone, the run is skipped and the domain drops back to the confirmed-email level. To say no in a way that sticks, set the value to securityscanner-verify=deny: the domain is then never scanned at either level.

    Agencies and developers: verify each client domain once and the monthly report for that domain goes to your address. Each client's own staff can also sign up with their own address.

  6. Coming later, by separate choice: the active scan

    An active scan sends requests that resemble attacks to find problems the passive scan cannot. It can fill in forms, create, modify or delete data, and leave entries in your logs. It is never on by default and it is not available yet. When it comes, it will be a separate yes for each domain, with the scanner's own warning about data changes shown first, and the recommendation will be to point it at a staging copy of the site. Until you take that step, nothing here ever submits a form or attacks.

  7. Stop any time

    Any of these stops the scans and the emails for a domain: the one-click unsubscribe link in any email (your email client's own unsubscribe button works too), removing the TXT record or the file, setting the record to securityscanner-verify=deny, or writing to abuse@securityscanner.org. Unsubscribing stops the scans as well as the email, always. A stop is honoured within two days and in practice within the hour. Your address and scan results are deleted 30 days after; the record that you authorised the scans is kept 13 months, as the privacy notice explains.

A few things worth knowing

Results in the email, for now

Today the whole report is in the email. Later, as the list grows, reports may move behind a click-through from the email, with a login and an anti-bot check on the way in, so that reports about your site are only ever read by you. The terms reserve that. The email itself always says the grade and what to fix first.

One domain per sign-up

Each domain is signed up on its own. If several people at one company sign up, each gets the report.

It is a check, not a guarantee

The scanner finds the common, visible problems. It cannot find everything, and a clean report does not mean a site cannot be broken into. It means the doors a bot tries first are shut. It is also not part of SOC 2: a clean scan says nothing about SOC 2 readiness, and no audit has been done.

Who sees the report

You, and the scanner's own log. Results are never published, never shared with hosts, vendors, sponsors or anyone else, and never used to sell you anything beyond the one paragraph at the bottom of each email about the paid inside work.