# A free website security scan, from the outside, with nothing to install.

> Check your website's security online for free: vulnerable versions, exposed files, HTTPS, headers and blacklists. A grade from 0 to 100, no sign-up.

URL: https://webintacta.com/en/free-website-security-scan
Language: English (Spanish version: see the hreflang alternate of the HTML page)
Last updated: 2026-10-24

**In short:** WebIntacta's website security scan (Jose Soriano) is free, online and needs no sign-up, and it takes a few minutes: you enter the address and it checks from the outside for versions with published vulnerabilities, exposed files, HTTPS, headers, domain email and blacklists. It gives a grade from 0 to 100 and a task list ordered by urgency. It installs nothing and doesn't try passwords, so it can't see what's hidden on the server; that's what the internal report is for, from €129.


Enter the address and the scanner checks what anyone can see of your website from the internet. It installs nothing, doesn't try passwords and doesn't touch your server. When it's done you get a grade from 0 to 100 and a task list ordered by urgency.

## What it checks

- Platform and version: WordPress, PrestaShop, WooCommerce, Shopify, Magento, Joomla, Drupal…
- Visible plugins, modules and libraries with published vulnerabilities
- Files that shouldn't be visible: backups, `.git`, `.env`, logs
- HTTPS certificate, redirects and security headers (HSTS, CSP…)
- Domain email: SPF, DKIM and DMARC
- Blacklists and scripts injected into the home page
- Readiness for AI agents (`robots.txt`, `llms.txt`, structured data), graded separately

## How I do it

1. **Enter your address.** Only websites you own or manage with permission.
2. **Read the result.** Grade, a plain-language summary and an action plan. You can share it with a private link.
3. **Decide.** Fix it yourself, pass it to your provider or hire me. If you also want to see what's inside, there's the report with the connector.

## Check your website's security online

Checking a website's security online, without installing anything, has a clear limit: you only see what the site shows to any visitor. Within that limit you find a lot, because most automated attacks look for exactly that: a known version, a forgotten file, a missing header.

## An online website vulnerability scanner, explained in plain English

The scanner identifies the platform and the visible versions and checks them against published vulnerabilities; it looks for paths that shouldn't respond (`/.git/`, `.zip` backups, `.env`); it checks the certificate, the [HTTP security headers](https://webintacta.com/en/guides/http-security-headers) and the domain email; and it looks up blacklists. Every problem comes with what it means, who should fix it and how urgent it is.

## A free website audit: how far it goes

It's a free first-pass audit, not a full audit. It can't see server files, the database or users. That's what the [website security audit](https://webintacta.com/en/website-security-audit) with the read-only connector is for. If you suspect something is already inside, read [how to tell if your website is hacked](https://webintacta.com/en/guides/how-to-tell-if-website-is-hacked) as well.

## Works with any platform

It detects WordPress, WooCommerce, PrestaShop, Joomla, Drupal, Magento, Shopify, site builders such as Wix and custom-built sites, and adapts the checks to each one. What's worth checking from the inside on each platform: [WordPress security](https://webintacta.com/en/wordpress-security), [PrestaShop security](https://webintacta.com/en/prestashop-security), [Joomla security](https://webintacta.com/en/joomla-security), [Drupal security](https://webintacta.com/en/drupal-security), [Magento security](https://webintacta.com/en/magento-security) and [Shopify security](https://webintacta.com/en/guides/shopify-security). Domain email has its own guide: [SPF, DKIM and DMARC](https://webintacta.com/en/guides/spf-dkim-dmarc).

## Price

The external scan is always free. The internal report sees what can't be seen from the outside.

### External scan — Free
Security grade and the problems visible from the internet, in a few minutes and with no sign-up.
- Platform and version (WordPress, PrestaShop, WooCommerce, Shopify…)
- Visible plugins and modules with published flaws
- Files that should not be public (backups, .git, configuration files)
- HTTPS, certificate and security headers
- Domain email (SPF, DKIM, DMARC) and blocklists
- AI agent readiness (scored separately)

### Security report · business website — €129 (excluding VAT)
An inside analysis with the read-only connector and a PDF with an action plan.

$129 outside the EU.
- Core integrity: every file compared with the original of your version
- Malware, backdoors and PHP where it does not belong
- Inventory of plugins or modules with versions and known flaws
- Administrator accounts, configuration and permissions
- Full PDF with fixes, plus a diagnosis-only version
- Q&A by email or chat to go through it together

> Fully credited if you hire a cleanup or maintenance within 30 days.

### Security report · online store — €169 (excluding VAT)
Everything in the website report, plus a review of checkout and the store's modules.

$169 outside the EU.
- Everything in the business website report
- Skimmers: scripts that copy cards at checkout
- Modified overrides and payment modules
- Database: scripts injected into content and settings

> Fully credited if you hire a cleanup or maintenance within 30 days.

Outside the EU the scan is just as free, and the internal report is $129.

## Frequently asked questions

### Does it detect viruses? What an external scanner can and can't see

It sees the symptoms that reach the browser: scripts injected into the home page, redirects, visible spam, blacklisted domains and versions with published vulnerabilities. It can't see what's hidden on the server without showing anything to the outside: a backdoor in a PHP file, a new administrator account or code in the database. A clean result makes an infection much less likely, but doesn't rule it out: that's what the [internal report](https://webintacta.com/en/website-security-audit) is for.

### Is it legal to scan a website?

The scan only looks at what the site shows to any visitor, with few requests and without trying to exploit anything. Even so, use it only on websites you own or manage with the owner's permission.

### Do you store my website or my data?

The scanned address and the result are stored, so I can show you the report and you can share it with a link that doesn't appear in search engines. I don't ask for your name or email to run a scan.

### How is it different from other free scanners?

It tells you what to do, in order and in plain English, and who should do it. And if you need it, there's a person behind it who can fix it.

Hire or ask (email and chat): https://webintacta.com/soporte?lang=en