1 Enter your domain
Create an account so results and authorised targets stay tied to you.
Evidence-led website security checks
Find website security gaps before attackers do
Safe, authorised checks for CVE candidates and common web security misconfigurations—explained in plain English with evidence and practical fixes.
Authorised targets only Bounded, non-destructive checks Evidence with findings
Start with a free check
What is visible on your domain?
Free single-host check. Unlock a detailed report only when you choose to.
Preview a sample report Clear from the start
How the scan works
2 Verify and scan
Where required, add a DNS TXT record to prove you control the domain before scanning.
3 Fix and rescan
Review evidence and remediation guidance, then use the included rescans to check changes.
Know what you are buying
Focused checks, defensible results
CVE Scanner combines externally visible technology evidence with a restricted, automated security assessment. It reports candidates and configuration gaps—not a guarantee that a website is completely secure.
See current coverage and price comparisonsCVE candidates linked to observed technology evidence
Security misconfigurations such as missing browser protections
Actionable evidence with confidence and recommended fixes
Simple one-off pricing
A useful report, without another subscription
Check the host you enter first. Unlock the detailed report for one host only when you want the evidence and remediation guidance.
£4.99
one-off per unlocked host
- Detailed findings and evidence
- Downloadable PDF report
- 2 included rescans
- No subscription
Common questions
Before you start a website security check
What’s free, and what does £4.99 unlock?
Start with a free supported check of a host you control and see the finding count. A one-off £4.99 unlocks the detailed report for that host, including available evidence, practical fixes, a downloadable PDF and two included rescans. There is no subscription.
Why do I need to verify domain ownership?
Ownership verification helps prevent unauthorised testing. When asked, add the DNS TXT record shown on the scan page to confirm control of the domain. We re-check authorisation before relevant scan work. Only test systems you own or have permission to assess.
How long does a check take?
Once ownership is verified, as a guide, allow around 1–2 minutes for a check. Some checks take longer depending on the host’s responses and the enabled assessment. Queueing, database startup and DNS verification can add time. Expanded Standard and Deeper modes are not available yet; once released, their worker budgets will be 2 and 5 minutes respectively, with saved progress and reopen/resume. A time limit is not a guarantee that every check will finish.
Does the price cover my whole domain?
No. Each unlocked report covers one host you choose, such as example.com or app.example.com. It does not cover all subdomains or every page of a website. We do not automatically discover or assess other hosts on the domain.
Do zero findings mean my website is secure?
No. Zero findings means the supported, completed checks did not identify findings. Failed, skipped or unavailable checks are not a pass. This focused external check is not comprehensive application testing or a penetration test, and a CVE candidate is not proof of an exploitable vulnerability.
What do the two included rescans cover?
They let you repeat the supported assessment for the same unlocked host after making changes. They do not unlock reports for other hosts. Expanded Standard and Deeper modes are not available yet; once released, either mode will use one existing rescan credit, with no separate Deeper surcharge. Coverage still depends on the released profile and usable evidence.