TLS & encryption
Checks the HTTPS certificate chain, expiry and protocol configuration, plus HTTP Strict Transport Security (HSTS).
Website scanner
Free website security scanner
Run a free, passive security scan of any website you own in seconds. AutoCloudPilot checks 17 areas — from TLS and security headers to DNS, email security and exposure files — then scores the results from 0 to 100. No signup, nothing stored.
New scan
Scan a website
Only scan sites you own or are authorized to test. The scanner never submits forms.
What it checks
What the free website security scanner checks
Every scan runs a set of passive, non-intrusive checks across 17 areas of your website's security posture.
Security headers
Reviews Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy.
Cookies & sessions
Flags cookies missing the Secure, HttpOnly or SameSite attributes, or using SameSite=None without Secure.
Forms & input handling
Inspects HTML forms for insecure submission over HTTP and for missing anti-CSRF protections.
Server & technology disclosure
Detects server banners, frameworks, CMS, CDN and analytics in HTTP headers and page HTML, including version leaks.
Exposure files & admin pages
Looks for robots.txt paths, publicly reachable log files, authentication and admin pages, and a security.txt (RFC 9116).
DNS & email security
Verifies SPF, DMARC, CAA and DNSSEC so your domain resists email spoofing and certificate misissuance.
CORS & Web Application Firewall
Tests for permissive cross-origin resource sharing and detects a fronting Web Application Firewall or edge proxy.
OSINT & AI readiness
Surfaces public contact details, historic web archive snapshots and an llms.txt file for AI and LLM crawlers.
How it works
How the free website security scan works
Enter a URL
Type the address of a website you own or are authorized to test, confirm your authorization and start the scan. No account is needed.
We run passive checks
The scanner sends a handful of read-only HTTP and DNS requests, much like a visitor loading a few pages. It never submits forms or attempts exploits.
Get a scored report
Findings are grouped by severity and category with clear evidence, a 0-100 security score and the specific fix for each issue.
Who it's for
Free website security checks for any team
Small business websites
Check that a marketing site or store has HTTPS, security headers, safe cookies and working email authentication.
Developers & DevOps
Scan after each deploy to catch header, cookie, TLS or DNS regressions before they reach production.
SaaS & agencies
Get an instant, shareable security snapshot for client sites and cloud-hosted applications you manage.
FAQ
Website security scanner FAQ
Is the website security scanner free?
Yes. The AutoCloudPilot website security scanner is completely free, requires no signup, and you can run as many scans as you like.
What does the website scanner check?
It runs 17 passive checks covering TLS and SSL configuration, HTTP security headers, cookie flags, HTML forms, server and framework disclosure, HTTP methods, robots.txt, authentication endpoints, exposed log files, security.txt, technology fingerprint, AI discoverability, CORS, WAF detection, public contacts, DNS and email security (SPF, DMARC, CAA and DNSSEC) and web archive snapshots, then scores the results from 0 to 100.
Is it legal to scan a website?
Only scan websites you own or are explicitly authorized to test. The scanner asks you to confirm authorization before every scan and only performs passive checks.
Does the scanner store my data?
No. Scans run in memory and nothing is stored or shared. The only input is the public URL you submit.
Will the scan affect or slow down my website?
No. The scanner makes a small number of read-only HTTP and DNS requests, similar to a visitor loading a few pages. It never submits forms or attempts exploitation.
Is this the same as a penetration test?
No. This is a lightweight passive assessment that flags common misconfigurations. For an in-depth review, engage a qualified penetration tester.
How often should I scan my website?
Run a scan after every deployment or configuration change, and at least monthly, to catch regressions in headers, cookies, TLS and DNS email security.
Also try
Free AWS IAM policy scanner
Paste or upload an AWS IAM policy JSON and get an instant least-privilege assessment. It flags risky permissions, privilege-escalation paths and missing guardrails — scored 0 to 100.
IAM, STS & Organizations
Detects identity tampering, AssumeRole abuse, long-lived federated tokens and risky changes to Organizations or account settings.
S3, KMS & Secrets
Flags bucket/object ACL changes, bucket policy edits, KMS key policy rewrites, key deletion and reading plaintext secrets from SSM or Secrets Manager.
Lambda, EC2 & Data services
Catches privilege-escalation paths via PassRole with Lambda/EC2/Step Functions, plus destructive actions on RDS, DynamoDB and backup vaults.
CloudTrail, GuardDuty & Logging
Warns when audit logging can be stopped or deleted, or threat detection disabled (tampering with observability).
Glue, SageMaker & Compute
Highlights job execution roles that could be abused via PassRole and infrastructure changes that expand attack surface.
Resource policies & trust
Detects public trust (Principal "*"), missing conditions (MFA, IP, external ID/org constraints) and broad managed policies like AdministratorAccess.
Want a deeper assessment?
The website scanner is one of the live tools. Explore the AWS IAM policy analyzer and see which broader security integrations are planned.