Fast & private
Results in seconds. No account required.
⚡ Free · No signup · 19 security checks
Website Security Scanner
Website Security Scanner
for Safer Deployments.
Scan your website before you deploy. Check security headers, CORS, cookies, mixed content, frontend exposure and common public deployment risks in seconds.
Starting scan…
Works with modern deployment stacks
▲ Vercel☁ Cloudflare✣ Netlify✦ Supabase⌁ Render◉ GitHub
19 security checks
Headers, cookies, CORS, frontend exposure, source maps, and more.
Actionable fixes
Understand what matters and what to change before launch.
Checks
Important: DeployPass v4.0 examines public responses and a limited sample of same-origin frontend assets. PASS means no obvious issue was detected by that check. N/A means the condition was not observable. Neither result proves an application is secure.
How it works
A deployment check you can understand.
DeployPass focuses on public signals a normal visitor can observe, then turns them into a short list of useful fixes.
01 · Scan
Enter a public URL
DeployPass fetches the page and a limited sample of same-origin frontend assets.
02 · Review
See what matters first
Get a score, severity breakdown, and clear explanations for warnings and critical findings.
03 · Share
Send the report
Every successful scan can create a private, unlisted report link for your developer or team.
Free website security tools
Run a focused check or scan everything.
Use a dedicated checker when you are troubleshooting one browser security control, or run the full 19-check DeployPass scan before launch.
H
Security Headers Checker
Review CSP, HSTS, MIME sniffing protection, Referrer-Policy, clickjacking controls, CORS and cookie security signals.
Check security headers →S
HSTS Checker
Inspect Strict-Transport-Security, max-age, includeSubDomains and preload directives with practical configuration guidance.
Check HSTS →C
CSP Checker
Analyze Content-Security-Policy directives, risky sources, framing controls and common CSP configuration issues.
Check CSP →M
Mixed Content Checker
Find insecure HTTP images, scripts, stylesheets, iframes and other resources loaded by HTTPS pages.
Check mixed content →O
CORS Checker
Test cross-origin response headers, credentials behavior, allowed methods and preflight signals for a public endpoint.
Check CORS →P
Permissions Policy Checker
Inspect the Permissions-Policy header and review browser feature controls for camera, microphone, geolocation, payment and more.
Check Permissions Policy →V
Website Vulnerability Scanner
Run a free passive vulnerability scan for security misconfigurations, missing protections and public deployment risks.
Scan for vulnerabilities →D
Deployment Security Check
Run a practical pre-deployment security check before launch and review the public risks that matter first.
Check before deployment →19
Full Website Security Scan
Run all 19 passive public-surface checks across headers, cookies, CORS, frontend exposure, source maps and deployment hygiene.
Run full scan →What we check
19 passive checks before launch.
No exploit attempts. No credential testing. No port scans. DeployPass stays on the public surface.
Security headers
HTTPS, CSP, HSTS, MIME sniffing protection, Referrer Policy and clickjacking controls.
Browser & cookie posture
CORS behavior, Secure / HttpOnly / SameSite cookie signals and obvious mixed content.
Frontend exposure
Secret-like patterns, public environment variables, source map references and debug indicators.
Deployment hygiene
Verbose error leakage, framework disclosure, scan coverage and public response review.
Website security scanner
A practical pre-deployment security scan for public websites.
DeployPass is a lightweight website security scanner built for the moment between “it works” and “ship it.” Enter a public URL to review browser-facing security controls, configuration signals and frontend exposure without logging in, brute forcing credentials, scanning ports or attempting exploitation.
Check the public surface before launch
A deployment can look correct while still shipping weak security headers, risky cookie flags, mixed HTTP resources, permissive cross-origin behavior or frontend debug signals. DeployPass groups these observable signals into one report so developers can review them before a release.
Focused checks when you need detail
Use the dedicated Security Headers, HSTS, CSP, Mixed Content, CORS and Permissions Policy tools when troubleshooting one control. Use the full website security scan when you want a broader pre-deployment review and a shareable result.
Designed for modern deployment stacks
The scanner works with public sites deployed on platforms such as Vercel, Cloudflare, Netlify, Render and GitHub Pages. Because DeployPass evaluates the response it can actually observe, a check may return N/A when a condition cannot be verified reliably.
Not a penetration test
DeployPass does not claim to prove that an application is secure. It is a passive website security scanner for fast configuration review before and after deployment. Application logic, authenticated routes and server-side vulnerabilities still require deeper security testing.
For developers
Built for the gap between “it works” and “ship it.”
Use DeployPass as a quick public-surface review after a deploy, before a launch, or before handing a build to a client.
Developer-friendly reports
Share one stable report URL instead of screenshots. Re-scan after fixes and compare the new result manually.
POST /api/scan
{ "url": "https://yourapp.com" }
→ score · verdict · checks · reportUrl
{ "url": "https://yourapp.com" }
→ score · verdict · checks · reportUrl
Designed to stay lightweight
DeployPass samples large responses instead of blindly downloading everything. If a condition cannot be reliably checked, it returns N/A rather than pretending it passed.
Pricing
Free while we validate the product.
No signup is required for the current public scanner.
DeployPass Free
$0 during beta
19 passive checks, actionable fixes, and shareable saved reports. Paid monitoring and deeper verified scans may come later.
Run a free scan →FAQ
DeployPass security scanner FAQ.
Is DeployPass a penetration test?
No. DeployPass performs passive checks against public website responses and a limited sample of same-origin frontend assets.
Which checker should I use?
Use the focused HSTS, CSP or Security Headers checker for a specific configuration. Use the full scan for a broader pre-deployment review.