Free Website Vulnerability Scan: What a Passive Scan Finds, and What It Can't
Run a free, production-safe website security scan with Ostorlab: TLS, security headers and known-vulnerable components. See what a passive scan finds, what it can't, and when you need an active test.
Free Website Vulnerability Scan: What a Passive Scan Finds, and What It Can't
Quick answer: Ostorlab's free website scan checks your site's TLS, security headers and known-vulnerable components without attacking it. It's passive, so you can run it on production. Enter a URL you own or are authorized to test, and the report is emailed to you.
What a passive scan finds
- TLS problems. Expired or weak certificates, old protocol versions, weak ciphers.
- Missing security headers. Content-Security-Policy, Strict-Transport-Security, X-Frame-Options and others that block common browser attacks.
- Known-vulnerable components. Outdated JavaScript libraries, CMS versions and server software with public CVEs.
- Exposed information. Version banners and pages that tell an attacker what you run.
These are the issues attackers find first, because automated tools scan the whole internet for them every day.
What it can't find
A passive scan doesn't log in, submit forms or send attack payloads. That means it can't find:
- broken access control, where user A can read user B's data (IDOR, BOLA)
- business logic flaws, like a discount applied twice
- injection flaws that only trigger on a submitted form or API call
These issues cause most serious breaches. Finding them takes an active, logged-in test. Ostorlab's Agentic Deep Scan for web explores the app like an attacker. With test setup, it handles SSO and MFA logins, and it proves each finding with reproducible evidence. For how dynamic testing works in general, see DAST (Dynamic Analysis), how does it work?.
Free scan or Agentic Deep Scan?
| Free web scan | Agentic Deep Scan | |
|---|---|---|
| Login | No | Yes, including SSO and MFA, with test setup |
| Attack payloads | No | Yes, controlled |
| APIs | No | Yes |
| Safe on production | Yes | Configurable |
| Proof for each finding | No | Yes |
| Price | Free | Paid plan |
See what an active test reports in the web sample report.
Try it on your own site: scan your website for free.
FAQ
Is the free website scan safe on production? Yes. It only crawls and reads responses. It submits no forms and sends no payloads.
Do I need to own the website? Yes. You must own the site or be authorized to test it, and you confirm that in the form.
Does the free scan test my API? No. API testing is part of Agentic Deep Scan.
What's the difference between a passive and an active website scan? A passive scan reads what the site exposes: certificates, headers and component versions. An active scan logs in and sends test requests to find access control, logic and injection flaws.