LIVE URL
See what your live website exposes
Paste your live website's URL to check HTTPS, security headers, public JavaScript and domain signals. Start a free public-site scan without signing up.
Enter a site you own or have permission to check. Guest scans have usage limits; additional domain checks require ownership verification.
How it works
- 01
Paste your live URL
Enter your site's address above and press Scan. Guests start a free scan immediately; signed-in users continue into the existing project flow.
- 02
Read your report
The report opens in the dashboard with findings from your public site. Free reports show titles and severity for all findings, with full details for a few top findings.
- 03
Fix and check again
Review the evidence, update your deployment and scan again. Add a repository or ZIP to inspect source code that a public URL cannot reveal.
What your scan covers
- Your public-facing setup
- Checks include HTTPS and TLS certificate signals, security response headers, exposed keys in public JavaScript, and DNS and email records where applicable.
- Verified-domain checks
- Additional checks for exposed files and publicly readable Supabase or Firebase data require ownership verification.
- Code needs a code source
- A URL-only scan cannot inspect private backend code or dependency manifests. It does not log into your app or execute its workflows. Connect GitHub or upload a ZIP for code checks; Deep scans require source code.
See coverage and limitations, how SetRepo handles your code and pricing.