Free passive scan · no attack traffic
Find your website's security gaps before attackers do
Enter your website address and ClearCitadel runs a safe, passive assessment in under a minute, with a clear grade, plain-English findings and a PDF report.
- Results in under a minute
- No installation
- PDF report included
- 1
- High
- 2
- Medium
- 1
- Low
- 3
- Info
- highGit repository is publicly accessible
- mediumNo Content-Security-Policy header
- mediumSession cookie without the Secure flag
- lowServer version disclosed in headers
What the free scan checks
Six areas attackers look at first
HTTPS & TLS
Certificate validity and expiry, obsolete protocols, weak ciphers, Heartbleed.
Security headers
CSP, HSTS, clickjacking protection, content-type sniffing, referrer policy.
Cookies & CORS
Secure, HttpOnly and SameSite flags; CORS policies that trust any website.
Exposed files
Publicly reachable .git folders, .env files, database dumps and phpinfo pages.
Outdated components
Front-end libraries such as jQuery, Bootstrap and AngularJS with known CVEs.
Email spoofing
SPF, DMARC, CAA and DNSSEC records for your domain.
How it works
From address to report in three steps
- 01
Enter your address
Type your website's domain. Nothing to install and no access to your server needed.
- 02
We assess it safely
A passive scan looks only at what any visitor's browser can already see. No attack traffic.
- 03
Get a graded report
A score from 0 to 100, a grade from A to F, and each finding explained with how to fix it.
Deep scan
Need a deeper assessment?
Deep scans actively test your application for vulnerabilities. Because active testing needs the site owner's permission, every deep scan is reviewed and started by the ClearCitadel team after you request it.
Port and service scan
Finds databases, remote admin and other services exposed to the internet.
Known vulnerabilities
Thousands of Nuclei templates for published CVEs and misconfigurations.
Web application scan
OWASP ZAP crawls the whole site and analyses every page and form.