Website Security Check: 9 Free Scanners to Use (October 2026)

Sucuri SiteCheck is a free online scanner that loads your site like a visitor and checks it for known malware, blocklisting, website errors and out-of-date software. Type your domain into sitecheck.sucuri.net and wait for the report. No sign-up needed.

• What it checks: malicious code, spam links and redirects in your page source, blocklist status with Google, PhishTank and others, a visible outdated CMS or plugin, and general security recommendations.
• What it can't see: anything on the server. Sucuri's own page says that because the scanner "only has access to what's visible on the browser level, it will not detect anything on the server-side". Its documentation adds that results "are not 100% accurate".
• Reading the result: red on malware or blocklisting means treat it as an incident today. Green means nothing malicious was visible when it scanned. The outdated-software line only appears when your site advertises a version, so silence there proves nothing.

Google's Safe Browsing site status page shows whether Google currently flags your site as unsafe, which is what puts warnings in front of visitors in Google Search and in web browsers. Search your domain on the Safe Browsing site status page. Google says it finds thousands of new unsafe sites every day, "many of which are legitimate websites that have been compromised".

• What it checks: Google's current verdict on a domain or URL.
• What it can't see: anything Google hasn't detected yet. It's a lookup of Google's list, not a fresh scan.
• Reading the result: "No unsafe content found" is the answer you want. "No available data" is common for small sites and just means Google has nothing to report. Any mention of unsafe pages means visitors are probably seeing warnings already, so clean up and ask for a review through Search Console.

Google Search Console's Security Issues report lists hacked content, malware and deceptive pages Google has found on your site, and it's the only place to ask Google to lift a warning once you've cleaned up. It's free, but you have to verify that you own the site first, and Google emails the verified owners when it finds something.

• What it checks: three kinds of hacked content (code injection such as malicious redirects, content injection such as spam links, and URL injection, where new spam pages appear on your domain), plus malware, unwanted software and social engineering.
• What it can't see: problems Google hasn't found. Google's help page also says the example URLs it lists are "not necessarily complete".
• Reading the result: "No issues detected" is good. If issues are listed, fix every affected page, then press Request Review. Google says a security review "can take from a few days to a few weeks".

One Singapore SME habit to fix: Search Console was set up years ago by a developer who has since left, and the alerts go to their inbox. Check who the verified owners are and add yourself.

VirusTotal checks a URL against more than 70 antivirus scanners and URL blocklisting services at once, so it shows whether security vendors have flagged your domain. Paste the address on virustotal.com. Its documentation says the service is free for non-commercial use.

• What it checks: each vendor's verdict on the URL and domain, plus details of the page it fetched.
• What it can't see: your server. It's mostly a reputation check.
• Reading the result: zero detections is normal. One or two flags from lesser-known engines can be false positives, so look at which vendor flagged it and ask that vendor to review. Several well-known engines flagging the same URL is a real problem.

VirusTotal says its reports "are shared with the public VirusTotal community". Don't submit a private staging address or a link with a login or reset token in it.

Mozilla's HTTP Observatory grades the security headers and related settings your server sends, from A+ down to F, and explains each test you fail. It now lives on MDN and needs no sign-up.

• What it checks: Content Security Policy, cookie settings, the redirect from HTTP to HTTPS, HSTS, Referrer-Policy, framing protection and similar headers. Every site starts at 100 points and loses points for failed tests, and a site scoring 90 or more can earn bonus points up to a maximum of 145.
• What it can't see: Mozilla is upfront that it "does not test for outdated software versions, SQL injection vulnerabilities, vulnerable content management system plugins". It also stopped testing TLS and certificates when the old Mozilla Observatory was retired in October 2024, so older guides that say it does are out of date.
• Reading the result: plenty of small business sites score D or F because nobody ever set these headers. A low grade means missing defensive settings, not a breach. Add a Content Security Policy carefully, because a strict one can break forms, chat widgets and analytics.

Mozilla's FAQ notes that each domain's scan history is public.

Security Headers, a free Snyk project at securityheaders.com, gives a quick letter grade for six common security headers and lists every raw header your server sends. It takes seconds.

• What it checks: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy, split into present and missing.
• What it can't see: anything beyond those response headers.
• Reading the result: the grade overlaps with Observatory. The raw headers list is the part worth reading for PHP. If it shows X-Powered-By: PHP/8.1.x, your server is announcing its PHP version to everyone, and your host or developer can switch that off with expose_php = Off.

Don't read too much into the number either way. A missing X-Powered-By header says nothing about patch status, and as the section below explains, the number it shows can be wrong.

Qualys SSL Labs' SSL Server Test is a free, thorough check of your HTTPS setup: the certificate, the TLS versions and ciphers your server accepts, and known TLS weaknesses, graded A+ to F. Run it at ssllabs.com/ssltest; a full test takes a couple of minutes.

• What it checks: the certificate chain and expiry, which TLS protocol versions are switched on, cipher suites and known TLS vulnerabilities.
• What it can't see: your website software, malware or PHP.
• Reading the result: A or A+ is the target. Since 31 January 2020, a server that still accepts TLS 1.0 or 1.1 is capped at B. A T grade means the certificate isn't trusted and an M means the name on it doesn't match your domain. Either can put a browser warning in front of visitors, so fix those today.

If your site is behind Cloudflare, you're grading Cloudflare's edge, not your own server. Tick "Do not show the results on the boards" if you'd rather your domain stayed off its public recent-scans lists.

WPScan is a free command-line WordPress vulnerability scanner that finds your WordPress version, plugins, themes and usernames from the outside and matches them against a database of known vulnerabilities. It runs on your own computer through Homebrew, RubyGems or Docker, so it suits technical users.

• What it checks: core version, the plugins and themes it can detect, user accounts it can list, and exposed backup folders. Vulnerability data needs a free API token: 25 requests a day for non-commercial use, and WPScan's pricing page says commercial use of the API needs a paid licence.
• What it can't see: plugins that leave no trace in the page source, the PHP version, and anything inside the dashboard.
• Reading the result: each finding names the plugin, the version it saw, the vulnerability and the version that fixes it. If the fix is newer than what you run, update. If WPScan can list your usernames, so can attackers, which is why 2FA matters more than hiding them.

If a command line isn't for you, Jetpack Protect is a free plugin that runs a daily check of core, plugins and themes inside your dashboard using the same WPScan database. Either way, run WPScan only against sites you own or are allowed to test.

php2shell-scanner is a free, open-source tool from Searchlight Cyber's Assetnote team that tests whether a server is vulnerable to PHP2Shell by trying to trigger the bug's memory error, rather than just reading a version number. It was published on 22 October 2026 on GitHub and needs Python 3.9 or later, so it's for technical users.

Searchlight's write-up describes three checks in order: try to trigger a PHP memory-exhaustion error, then look for a telltale empty HTTP 500 from a crashed PHP-FPM worker, and only as a last resort read the advertised PHP version. It says most other scanners "rely on version checks".

• Only scan your own servers. The tool sends a few large requests, around 29 MiB per page tested according to its README, designed to push PHP into an error. Searchlight says a worker crash is usually recovered quickly, but "care and caution should still be taken". Run it in a quiet hour and tell your host first. Pointing it at someone else's server could breach Singapore's Computer Misuse Act.
• Expect false positives. The README says patched PHP 8.4.27 and 8.3.36 can return the same empty HTTP 500 under some settings, and that "Results should therefore be verified against the installed PHP version and any vendor backports."
• Use the assetnote repository. Other projects on GitHub use similar names. Tenable's PHP2Shell FAQ warns that "Unverified exploit code is sometimes laced with malware".