Free Website Security Scanners in 2026: What Each One Actually Checks
Most "is my website secure?" scanners are checking something narrower than the question implies, and if you don't know which narrow thing, you'll walk away from a green checkmark with a false sense of safety. One tool grades your TLS configuration and says nothing about your response headers. Another grades your headers and never looks at your certificate. A third runs a full authenticated pentest and is wildly overkill for "I just shipped a landing page and want to know if I forgot anything obvious."
I ship web apps, and I break them on purpose to find out where they leak before someone else does. Over the years I've run all of these scanners against real production sites — mine and clients' — and they sort cleanly into "run this first," "run this for TLS specifically," and "run this when you're past the basics." Full disclosure up front: I built one of the tools below (SiteGuard), so I'll be explicit about where it's the right call and where one of the others clearly wins.
What "scanning a website" even means
An external, unauthenticated scanner — the kind you point at a URL without logging in — can only see what an anonymous visitor's browser sees. That's a real, useful slice, and it's exactly the slice that's easiest to get wrong and cheapest to fix. It breaks down into roughly four buckets:
- Transport security (TLS): is your certificate valid, is the protocol/cipher configuration modern, are you forcing HTTPS, is HSTS set?
- Response headers:
Content-Security-Policy,X-Content-Type-Options,X-Frame-Options/frame-ancestors,Referrer-Policy,Permissions-Policy— the cheap, declarative defenses against XSS, clickjacking, and information leakage. - Cookie hygiene and information disclosure:
Secure/HttpOnly/SameSiteflags, leaked server-version banners, exposed.gitdirectories, verbose error pages. - Application-level vulnerabilities: actual injection, broken auth, misconfigurations that need crawling and probing rather than reading one response.
No free, instant, unauthenticated scan touches that last bucket properly — that's pentest territory. The tools below mostly compete on the first three, and they weight them very differently. Here's how I'd choose.
The honest summary
Mozilla HTTP Observatory if you want the most respected, opinionated header grade with concrete remediation, backed by Mozilla's own security guidance.
securityheaders.com if you want the fastest possible "what headers am I missing" letter grade, from the person who has written more about these headers than anyone.
Qualys SSL Labs if the question is specifically "is my TLS/certificate configuration any good," where it is the long-standing gold standard.
ImmuniWeb Community Edition if you want a broader free report that folds in privacy/compliance and known-CVE signals alongside the basics.
SiteGuard (ours) if you want a no-signup, one-field instant letter grade across headers, TLS, and cookie hygiene in a single readable report — the "just tell me what I forgot" scan.
Where Mozilla Observatory wins
The grade comes with a worldview. Observatory doesn't just report which headers are present — it scores them against Mozilla's published web security guidelines, so the A-through-F grade reflects an actual opinion about what a well-configured site looks like in 2026. CSP gets weighted heavily, because Mozilla (correctly) thinks it should be.
The remediation is concrete and link-backed. Each finding points at the relevant MDN/Mozilla documentation, which means a junior dev can go from "you're missing X" to a correct fix without you in the loop. For teaching a team to care about headers, it's the best free option.
Where it stops: it's deliberately focused on the HTTP/header layer. It is not your TLS deep-dive, and the scan can be stricter than some teams want for a simple marketing site — a perfectly safe static page can score lower than its real risk because it hasn't bothered with a full CSP.
Where securityheaders.com wins
It is the fastest answer to one specific question. Paste a URL, get a letter grade and a green/red checklist of response headers in seconds. Scott Helme has been writing the canonical material on these headers for years, so the tool encodes a lot of hard-won judgment about what actually matters and what's cargo-culted.
It's the shared vocabulary. "We're a B on securityheaders, let's get to A" is a sentence engineering teams actually say, because everyone knows the tool. That social proof has real value when you're trying to get header work prioritized.
Where it stops: by design it looks at response headers and not much else. It won't grade your TLS configuration, won't flag an exposed .git, won't comment on cookie flags beyond what's in the headers. It's a sharp tool for one job, not a whole-site picture.
Where Qualys SSL Labs wins
It is the TLS authority, full stop. If your actual question is about certificates, protocol versions, cipher suites, forward secrecy, or whether you're still leaving TLS 1.0 enabled for some forgotten legacy client, SSL Labs is the deepest free analysis that exists and has been for over a decade. The grade is taken seriously across the industry.
It surfaces the subtle stuff. Chain issues, weak DH params, configuration that works in a browser but is one deprecation away from breaking — SSL Labs catches the things that pass casual inspection and bite you on a future client update.
Where it stops: it is exclusively about TLS. A flawless A+ on SSL Labs tells you nothing about whether you've set a Content-Security-Policy or whether your cookies are HttpOnly. It's one (excellent) instrument, not the dashboard.
Where ImmuniWeb Community Edition wins
It bundles more into one free report. Alongside headers and TLS, the free tier pulls in privacy/compliance angles (GDPR/PCI-flavored checks), known-CVE signals for detected software, and a broader surface read than the single-purpose tools. If you want one report to skim that touches several dimensions, it covers more ground.
Good for a compliance-adjacent first look. The framing toward regulatory checklists is genuinely useful if "are we presentable for an audit" is part of why you're scanning at all.
Where it stops: breadth comes with noise — the free report mixes signal you can act on with findings that are informational or marketing-adjacent, and the deeper, actionable detail is gated behind the paid product. It's a good wide-angle snapshot, less so a focused punch list.
Where SiteGuard wins (and where it doesn't)
I built SiteGuard after running the four tools above one too many times in sequence for the same simple question — "I just deployed this, did I forget anything dumb?" — and wishing one of them gave me the combined header + TLS + cookie picture in a single readable grade without sending me to four tabs. So that's exactly what it does: one field, paste your URL, get an instant A-through-F grade with the specific issues and how to fix them, no account and no email required to see the result.
One scan, the whole front-door picture. SiteGuard checks the security headers, the basics of your TLS posture, and cookie/disclosure hygiene together, then rolls them into a single grade with a prioritized list. It's built for the moment right after you ship, when you want a fast, honest "here's what's weak" rather than four separate deep dives.
No signup to get value. The scan and the result are free and instant — you see your grade and findings before anyone asks you for anything. If you want it to keep watching a site and tell you when something regresses, you can opt in to that, but the core "tell me what's wrong right now" answer costs you nothing and no friction.
Where it doesn't win: if your question is specifically and deeply about TLS, run SSL Labs — its cipher/chain analysis is deeper than any combined scan needs to be, and I won't pretend otherwise. If you want the most authoritative, Mozilla-blessed header grade with MDN-linked fixes for a team to learn from, Observatory is the teaching tool. SiteGuard is deliberately the fast, combined, no-friction first scan — that's the job it's for, and it hands you off to the specialists when you need to go deep.
The decision tree
"I just shipped something and want one fast grade across the obvious stuff." → SiteGuard.
"I want the authoritative header grade with fixes my team can learn from." → Mozilla Observatory.
"I just want the fastest missing-headers checklist." → securityheaders.com.
"My question is specifically about TLS/certificates." → Qualys SSL Labs.
"I want a wide compliance-flavored snapshot in one report." → ImmuniWeb.
The thing nobody tells you about security scans
A grade is not a fix, and the gap between "I scanned it" and "I changed something" is where almost everyone stalls. I've watched teams run a scan, screenshot the B-minus, paste it into Slack, feel briefly responsible, and change nothing — because the scan produced a feeling of diligence without producing a single committed line of config. The scanner did its job; the loop never closed.
So treat the scan as the cheap, easy half. The moment you have a grade, do exactly one thing before you close the tab: pick the single highest-severity finding and either fix it now or write a ticket with the literal header/config line that resolves it. Most of these findings are one line in your reverse proxy or framework config — a Strict-Transport-Security header, a SameSite flag, forcing the HTTPS redirect. The reason the front-door category exists at all is that the fixes are trivial and the omissions are silent. The scan tells you which line you forgot; only you can go type it.
And re-scan on a schedule, not once. Header config drifts when someone adds a CDN, swaps a framework version, or "temporarily" loosens a CSP to debug a third-party widget and forgets to put it back. The grade you earned in March is not the grade you have in June unless something is checking.