Analyze websites for OWASP Top 10 security vulnerabilities based on HTTP headers and configuration.
OWASP Scanner is a free, browser-based tool that checks a website or web application against common issues drawn from the OWASP Top 10, the industry-standard list of the most critical web application security risks. You enter a target URL (for example https://example.com) and the scanner inspects publicly observable signals such as HTTP response headers, cookie flags, TLS/redirect behavior, exposed server banners, and the presence of common security controls, then reports likely weaknesses grouped by risk category.
It is aimed at developers, site owners, QA engineers, and security-conscious admins who want a fast first-pass assessment before a deeper manual pentest or a full authenticated scan. Because it is passive and non-intrusive, it focuses on configuration and hardening findings (missing headers, weak cookie attributes, information disclosure) rather than active exploitation.
The scanner performs a passive assessment: it issues standard HTTP(S) requests to the target and analyzes what comes back, without attempting injection, brute force, or any action that would alter the target's state. It maps observable evidence to OWASP Top 10 categories. For instance, a missing Strict-Transport-Security header or a site reachable over plain HTTP maps to Cryptographic Failures (A02); missing Content-Security-Policy, X-Frame-Options, or X-Content-Type-Options maps to Security Misconfiguration (A05); a verbose Server or X-Powered-By banner that leaks framework and version maps to information disclosure.
Common checks include whether cookies carry the Secure, HttpOnly, and SameSite attributes; whether HTTP requests are redirected to HTTPS; whether directory listing or default error pages reveal internals; and whether recommended response headers are present and well-formed. Each finding is a signal, not proof of exploitability, so results should be validated in context.
Because the OWASP Top 10 is a risk-awareness document rather than a checklist, a clean pass here does not certify an application as secure. It is best used as a lightweight, repeatable baseline to catch obvious hardening gaps, complemented by authenticated scanning, dependency analysis, and manual testing for logic flaws that no passive tool can detect.
Yes, the scanner is completely free to use with no signup required. It only inspects the public URL you submit and does not store your target list or credentials; you should still only scan sites you own or have explicit permission to test.
No. It runs a passive assessment using standard HTTP requests and reads the responses. It does not attempt SQL injection, brute force, or any action that modifies your server or data.
No. A clean pass only means the passive, configuration-level checks did not find obvious issues. Business-logic flaws, injection vulnerabilities, and access-control bugs require authenticated and manual testing that a passive scanner cannot cover.
It focuses on categories detectable from external responses, such as A02 Cryptographic Failures (TLS and HTTPS enforcement), A05 Security Misconfiguration (missing or weak security headers and cookie flags), and information disclosure from server banners. Categories requiring code or authenticated access are outside its scope.
You should only scan domains you own or are authorized to test. Even passive scanning of third-party sites without permission can violate acceptable-use policies, so limit use to your own properties.
The scanner reports what the edge returns. If your CDN or WAF strips or overrides headers, findings reflect that configuration; fixes often need to be applied at the CDN or reverse-proxy layer rather than only the origin server.
Re-scan after any deployment, header change, TLS renewal, or infrastructure update, and on a regular schedule such as monthly, since configuration can drift over time.