Free website vulnerability scanners: what an online security check can and can't tell you

Search for a website security check and you'll find dozens of free tools. They don't all do the same job: some read 1 page the way a browser does, some look for malware, some grade your server's settings, and a few send real attack traffic. Knowing which kind you ran tells you what its result means.

There are 5 kinds, each with a well-known example. PHP Scanner is the narrowest: it looks for 1 known flaw and nothing else.

• Passive checks for 1 known flaw, like PHP Scanner for PHP2Shell.
• Malware and blacklist scanners, like Sucuri SiteCheck.
• Security header checks, like Mozilla's HTTP Observatory.
• CMS-specific scanners, like WPScan for WordPress.
• Active scanners (DAST), like ZAP, which send test attacks.

What any outside check can and can't see

Every online scanner works from outside your server. It reads what your site sends any visitor: pages, response headers, cookie names, the page's code, and whether your address is on public block lists. It can't log in, read your server's files, look at your database, or see other servers your business uses.

So no outside check can prove a site has no problems; that would take full access to the server, or attacking it. A trustworthy tool says what it looked at and what it couldn't see.

1. Passive checks for 1 known flaw

A passive check loads your page once and compares what it sees with 1 specific, published flaw. PHP Scanner is this kind. It looks only at PHP2Shell (CVE-2026-109618 and CVE-2026-109619), the critical PHP flaws fixed in 8.2.35, 8.3.36, 8.4.27, 8.5.12.

• What it does: 1 ordinary page load plus any redirects. It reads response headers, cookie names and the page's code to tell whether the site runs PHP, which version the server reports, and who most likely updates it.
• What it doesn't do: it sends no attack traffic and never tests whether the flaw works. It doesn't look for malware, other flaws, plugin problems or header settings, and it can't see a version your server hides.
• Good for: a quick, plain-language answer when a specific flaw is in the news. How it works lists exactly what PHP Scanner requests and reads.

2. Malware and blacklist scanners

These visit your site the way a regular visitor would and look for signs that something has already gone wrong: injected scripts, spam links, suspicious redirects, and whether security services list your address as harmful.

Sucuri SiteCheck is a free example. It scans the public side of a site for malware, malicious code, spam and unwanted redirects, checks blacklist status with authorities such as Google, and flags an outdated CMS or plugins. Sucuri is clear about the limit: a remote scan doesn't see anything on the server side.

Good for: a browser or search warning about your site, customers reporting strange pages, or a sudden drop in traffic.

3. Security header checks

With every page, your server sends instructions to browsers called HTTP headers: use HTTPS only, which sources may load scripts, how to treat cookies. A header check reads them and grades the setup.

Mozilla's HTTP Observatory, on MDN, assesses a site's HTTP headers and other key security settings, and gives a letter grade from A+ to F based on a score that starts at 100. Its FAQ says plainly that it doesn't test for outdated software versions or CMS plugins with known flaws, and that a top grade doesn't mean a site has no issues. Scan history for each domain is public.

Good for: a developer tightening a site's settings, or an item on an IT or compliance checklist.

4. CMS-specific scanners for WordPress

WordPress sites share a common structure, so a scanner built for WordPress can work out which versions of WordPress, plugins and themes a site runs, then match them against a database of known flaws.

WPScan, run by Automattic, keeps a database of known WordPress core, plugin and theme flaws and offers a free site scan, where you confirm you have permission to scan the site. Its command-line scanner detects the WordPress version, themes, plugins and users; vulnerability data needs an API token, and the free plan, for non-commercial use, allows 25 API calls a day. Its documentation warns that scanning a site without consent may be illegal in some countries.

Good for: WordPress sites with many plugins. It checks WordPress and its add-ons, not PHP itself; How to update PHP in WordPress covers that.

5. Active scanners (DAST)

Dynamic application security testing (DAST) tools crawl a site, then send real attack requests to see how it responds. They find things the other 4 kinds can't, because they actually try, which is also why they come with a warning.

ZAP (Zed Attack Proxy, once OWASP ZAP and now ZAP by Checkmarx) is a free, open-source penetration testing tool for Windows, Linux, macOS and Docker. Its passive scan only watches traffic; its active scan launches known attacks. ZAP's own guide says to run active attacks only against applications you have permission to test, because they can damage a site's functions or data.

The 5 kinds side by side

Which check should you run?

• A flaw is in the news and you want to know if it applies to you: a passive check for that flaw. For PHP2Shell, that's PHP Scanner. Is my website affected by PHP2Shell? walks through the result.
• Your browser or Google shows a warning, or pages look odd: a malware and blacklist scanner, then your host or developer.
• Someone asked about your security headers: a header check, then your developer.
• You run WordPress: a WordPress scanner or a security plugin, and keep WordPress, plugins and themes updated.
• You're launching or changing an app you own: an active scanner, run by a developer on a staging copy.

None of these replace the basics. Keep your software updated, including the PHP version your host runs, which no WordPress update touches. If you're not sure which PHP version that is, How to check your PHP version shows where to look.