Scan your website for security issues with a free vulnerability scanner. Detect exposed configuration, missing browser protections, insecure resource loading and common deployment risks before launch — without exploitation, login attempts or intrusive testing.
Public HTTP/HTTPS URLs only. DeployPass performs passive public-surface checks.
A website vulnerability scanner helps identify security weaknesses that may be visible when a website or web application is accessed from the internet. Some scanners actively probe an application for exploitable flaws. DeployPass takes a narrower approach: it reviews public, browser-facing security signals and deployment configuration without attempting to exploit the target.
That makes the scanner useful as a fast security check before launch, after a deployment, or when configuration changes move through a CDN, reverse proxy or hosting platform. A page can work perfectly for users while still missing protections such as Content Security Policy, HSTS, secure cookie attributes or sensible cross-origin rules. Those issues are easy to overlook because they often live outside the application code itself.
DeployPass turns those observable signals into a practical report. It is designed for developers who want to scan a website for vulnerabilities and configuration risks quickly, understand why a finding matters, and then verify the fix. It is not a promise that a website is vulnerability-free, and it should complement — not replace — code review, dependency scanning and deeper security testing for high-risk applications.
The scan groups public-facing signals into areas that commonly change during deployment. Each category answers a different question about how the site is exposed to browsers and other origins.
Checks browser protections such as Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, Referrer-Policy and related headers. Missing headers are not automatically proof of exploitation, but they can remove useful layers of defense and often indicate deployment configuration that deserves review.
Reviews HTTPS-facing behavior and looks for insecure HTTP resources referenced from secure pages. Mixed content can weaken transport guarantees and create browser warnings or blocked resources. The goal is to catch issues introduced by old asset URLs, redirects, proxies or deployment-specific configuration.
Reviews observable Set-Cookie attributes such as Secure, HttpOnly and SameSite. These attributes help constrain when browsers send cookies and whether client-side scripts can access them. The correct policy depends on how your application authenticates users and whether cross-site flows are intentional.
Inspects cross-origin response signals, including Access-Control-Allow-Origin and credential-related behavior. CORS is context dependent: allowing another origin is not inherently a vulnerability. DeployPass highlights combinations that deserve review rather than treating every permissive-looking header as a confirmed exploit.
Looks for publicly observable frontend signals that may reveal unnecessary implementation detail, debug artifacts or deployment information. Client-side code is inherently public, so the objective is not to label normal JavaScript as a secret; it is to identify exposure patterns worth checking before production.
Reviews policies such as Permissions-Policy and other browser-facing controls that limit access to powerful features. These policies can reduce unnecessary capability and make application intent clearer. DeployPass reports missing or broad policies as review items when appropriate, not as automatic proof of compromise.
Automated vulnerability scanning and penetration testing solve different problems. A scanner is fast, repeatable and useful for catching known classes of security or configuration issues. A penetration test goes deeper: a security professional may examine authentication, authorization, application logic, infrastructure and whether weaknesses can actually be chained or exploited.
Automated, repeatable and low impact. Best for quick public-surface checks before or after deployment. It does not log in, brute-force accounts, inject attack payloads, scan private networks or attempt to prove exploitability.
Broader and more contextual. It may include authenticated testing, business-logic review, exploit validation and manual investigation. Applications handling sensitive data or important business processes should consider professional testing in addition to automated checks.
In practical terms, use DeployPass as an early warning system and deployment gate. If it flags a missing control, fix it and rescan. If your threat model requires assurance against SQL injection, authorization flaws, server vulnerabilities, dependency CVEs or complex attack chains, use security tooling designed for those areas as well.
Use a public HTTP or HTTPS address that the scanner can reach. A production site, public preview deployment or internet-accessible staging environment can be checked. Private localhost and internal-only hosts are intentionally excluded.
DeployPass requests the public site and analyzes observable response headers, browser policies and deployment signals. The scan is designed to be low impact and does not require credentials or installation on the target.
Use the score as a summary, then read individual findings. A warning is a prompt to investigate context, not proof that an attacker can compromise the site. Focus first on findings that affect the protections your application actually relies on.
Update the application, CDN, proxy or hosting configuration that controls the affected signal. Redeploy, rerun the scan and confirm that the expected response is now visible from the public internet.
Developers can use it as a quick pre-deployment review when security headers and hosting configuration sit outside normal application tests. Indie hackers and small teams can add a lightweight check before shipping an MVP. Agencies can use a repeatable scan when handing off a site or validating a production deployment. Startups can use the report to catch browser-facing regressions while their infrastructure is changing quickly.
The scanner is especially useful when a site moves between platforms or adds a CDN, reverse proxy, authentication provider or new frontend integration. Those changes can modify headers, redirects, cookies and cross-origin behavior without obvious visual symptoms. Running the same check before and after deployment gives you a simple way to verify what the public site actually exposes.
For a launch-focused workflow, pair this page with the Deployment Security Check. For a narrower diagnosis, use the focused checkers below instead of rerunning a broad scan for every individual header.
A passive website vulnerability scanner can identify security misconfigurations that are visible from a public URL, including missing browser security headers, weak cookie attributes, HTTPS and mixed-content issues, CORS exposure, browser policy gaps, and frontend information that should not be exposed. DeployPass focuses on observable deployment risks rather than attempting to exploit the target.
Yes. DeployPass lets you run the public-surface website vulnerability scan without creating an account. Enter a public HTTP or HTTPS URL and review the findings. The scan is intended as a fast pre-deployment or post-deployment security review, not a replacement for a complete professional security assessment.
DeployPass does not attempt to break into the website. Its scanner uses passive and low-impact requests to inspect publicly observable responses and configuration signals. It does not perform SQL injection, password attacks, authenticated exploitation, destructive testing, or intrusive penetration-testing techniques.
Run a scan before an important deployment and again after changes that affect hosting, headers, authentication, cookies, CDN rules, redirects, or frontend configuration. Rechecking after a fix is also useful because a change in the application, reverse proxy, CDN, or hosting platform can alter the security signals exposed to browsers.
A scanner automates repeatable checks and quickly highlights known classes of configuration risk. Penetration testing is broader and usually involves a security professional actively testing application logic, authentication, authorization, infrastructure, and exploitability. DeployPass is intentionally on the safe, passive-scanning side of that distinction.
Yes, if the staging URL is publicly reachable from the internet. Private localhost addresses, internal network hosts, and protected staging environments cannot be inspected by a public scanner. For a public preview deployment, scanning before production can catch browser-facing configuration problems early.
No scanner can guarantee that. DeployPass does not claim to discover every application, server, dependency, or business-logic vulnerability. It is designed to surface common public-facing security and deployment issues quickly. High-risk applications should also use code review, dependency scanning, authenticated testing, and professional penetration testing where appropriate.
Read the finding and verify whether it applies to your application. Fix the relevant application, CDN, reverse-proxy, or hosting configuration, deploy the change, and scan again. Use the focused DeployPass checkers for headers, HSTS, CSP, CORS, mixed content, and Permissions Policy when you need a narrower diagnostic view.
Inspect the browser security headers returned by a public URL.
Check Strict-Transport-Security and HTTPS enforcement signals.
Review a Content Security Policy and common configuration gaps.
Inspect cross-origin response behavior and credential-related settings.
Find insecure HTTP resources referenced by an HTTPS page.
Review browser feature permissions exposed by the site.