CHECK YOUR LIVE WEBSITE
Free website security scanner
Check HTTPS, security headers and public JavaScript for exposed keys. Get findings you can review and act on.
Start with a site you own or have permission to check. Guest scans have usage limits; additional domain checks require ownership verification.
From URL to next steps
- 01
Enter your website
Paste your live URL above to start the free public-site scan. You can also connect code for broader coverage.
- 02
Review the evidence
Read the findings and what the scan could check. Investigate a reported issue against your app's actual configuration.
- 03
Fix and retest
Prioritize confirmed exposures, deploy your changes, and repeat the scan. Keep manual access tests on your checklist.
What can this website scan check?
A live URL reveals your public-facing setup. Source-code access adds a different set of checks. The report identifies coverage and skipped checks for your app.
- HTTPS and TLS certificateLive URL
- Checks the site's connection and certificate signals.
- Security response headersLive URL
- Reviews headers sent by the public site, including CSP and HSTS.
- Keys in public JavaScriptLive URL
- Looks for exposed secrets and Supabase or Firebase configuration in served scripts.
- DNS and email recordsLive URL
- Checks domain signals and email authentication records where applicable.
- Exposed files and public dataVerified domain
- Additional checks for exposed files and publicly readable Supabase or Firebase data require ownership verification.
- Backend code and dependenciesSource code
- Provide a repository or zip to check server routes, dependency manifests and configuration.
- Selected access and business logicPaid Deep scan
- Adds AI review of selected source code. It does not log into your app or execute its workflows.
Read the full coverage and limitations before treating a finding or a clean result as a release decision.
UNDERSTAND YOUR RESULTS
Findings with a next step
An issue needs context. Check where the evidence came from, whether it affects private data, and which configuration or code change will address it.
For an exposed secret, revoke and rotate the credential before relying on a code change. For a missing header, design and test a policy that fits your app. For a certificate error, check the certificate and hosting configuration on the affected domain.
Follow the website security walkthrough →EXAMPLE FINDINGS · ILLUSTRATIVE DATA
Exposed private key in browser JavaScript
Evidence: public script · value redacted
Revoke the key, move it server-side and redeploy.
Missing Content-Security-Policy header
Evidence: document response headers
Design a policy and test it before enforcement.
Expired TLS certificate
Evidence: certificate on the scanned domain
Renew the certificate and verify the served chain.
What a public URL cannot tell you
A website scanner cannot prove your app is secure. A URL-only scan cannot inspect private backend routes, database policies or dependency manifests. SetRepo does not log in, execute your application code or conduct a penetration test.
Test account ownership, roles, password recovery and payment workflows separately. Connect a repository or upload a zip for code checks; a paid Deep scan adds AI review of selected code. See pricing and how SetRepo handles your code.
Website security scanner FAQ
Is the website security scan free?
Yes. You can start a free live URL scan without signing up or entering a credit card. Guest scans have usage limits. Code scanning and paid Deep scans have different coverage; see the pricing and accuracy pages for details.
Can I scan a website without its source code?
Yes. A live URL scan checks the publicly reachable site, including HTTPS, response headers and served JavaScript. It cannot review private source code, backend routes, database rules or dependency manifests that you have not provided.
Does a clean scan mean my website is secure?
No. It means the checks that ran did not report an issue. A URL scan does not log in, test every user role or prove that private data is protected. Use code review, manual access tests and a security review appropriate to the app's risks.
Does SetRepo attack my website or use exposed keys?
SetRepo checks publicly reachable responses and code. It does not log into your app, run your application code or try the secret keys it finds. Extra checks for exposed files and publicly readable Supabase or Firebase data require domain verification.
What should I do after a scan?
Review the evidence, confirm each finding and fix issues that expose secrets or private data first. Revoke and rotate leaked credentials, deploy your changes, and scan again. Use the walkthrough and launch checklist for checks that need source code or manual testing.