1 Enter your domain
Create an account so results and authorised targets stay tied to you.
Evidence-led website security checks
Find website security gaps before attackers do
Safe, authorised checks for CVE candidates and common web security misconfigurations—explained in plain English with evidence and practical fixes.
Authorised targets only Bounded, non-destructive checks Evidence with findings
Start with a free check
What is visible on your domain?
Free single-host check. Unlock a detailed report only when you choose to.
Preview a sample report Clear from the start
How the scan works
2 Verify and scan
Where required, add a DNS TXT record to prove you control the domain before scanning.
3 Fix and rescan
Review evidence and remediation guidance, then use the included rescans to check changes.
Know what you are buying
Focused checks, defensible results
CVE Scanner combines externally visible technology evidence with a restricted, automated security assessment. It reports candidates and configuration gaps—not a guarantee that a website is completely secure.
See current coverage and price comparisonsCVE candidates linked to observed technology evidence
Security misconfigurations such as missing browser protections
Actionable evidence with confidence and recommended fixes
Simple one-off pricing
A useful report, without another subscription
Check the host you enter first. Unlock the detailed report for one host only when you want the evidence and remediation guidance.
Standard
£4.99
one-off per unlocked host
- Detailed findings and evidence
- Downloadable PDF report
- 2 included rescans
- No subscription
Deeper £9.99 · public beta
Broader same-host checks, report, PDF and two Deeper rescans. No Standard purchase required. Validation is ongoing; incomplete checks are shown in the report.
Common questions
Before you start a website security check
What’s free, and what do the Standard and Deeper packages cost?
Start with a free supported Standard check of a host you control and see the finding count. Standard is £4.99 and Deeper is £9.99, one-off per host. Each includes the detailed report, available evidence, practical fixes, a downloadable PDF and two included rescans at the purchased level. Deeper is offered as a public beta, with no Standard purchase required. Validation is ongoing and availability is confirmed before checkout. There is no subscription.
Why do I need to verify domain ownership?
Ownership verification helps prevent unauthorised testing. When asked, add the DNS TXT record shown on the scan page to confirm control of the domain. We re-check authorisation before relevant scan work. Only test systems you own or have permission to assess.
How long does a check take?
Once ownership is verified, as a guide, allow around 1–2 minutes for a Standard check. Some checks take longer depending on the host’s responses and the selected assessment. Queueing, database startup and DNS verification can add time. The beta Standard and Deeper worker budgets are 2 and 5 minutes respectively, with saved progress and reopen/resume. A time limit is not a guarantee that every check will finish.
Does the price cover my whole domain?
No. Each unlocked report covers one host you choose, such as example.com or app.example.com. It does not cover all subdomains or every page of a website. We do not automatically discover or assess other hosts on the domain.
Do zero findings mean my website is secure?
No. Zero findings means the supported, completed checks did not identify findings. Failed, skipped or unavailable checks are not a pass. This focused external check is not comprehensive application testing or a penetration test, and a CVE candidate is not proof of an exploitable vulnerability.
What do the two included rescans cover?
They let you repeat the supported assessment at the purchased package level for the same unlocked host after making changes. Standard credits do not unlock Deeper, and neither package unlocks other hosts. The Deeper package includes its initial Deeper assessment followed by two Deeper rescans. Existing Standard purchases and their remaining credits remain valid. Coverage still depends on the selected profile and usable evidence; incomplete checks are not passes.