Step-by-step guide

How to scan a website for vulnerabilities

You can learn a lot about your own site for free in an afternoon. Here is the order to do it in, which tools to use, and the things no scan will ever tell you.

By the Bug Circuit security team · Last updated October 22, 2026

How do you scan a website for vulnerabilities? 1. Get permission (only scan sites you own), 2. run a passive check of subdomains, technology and DNS, 3. test security headers, the SSL certificate and email authentication, 4. run a free active scanner such as ZAP on a staging copy, 5. check plugins and libraries for known issues, 6. fix the critical and high findings first, 7. have a person test the logic. Steps 1 to 5 cost nothing. Step 7 is what scanners cannot do.

Step 1: Only scan what you own

Scanning a website without the owner’s permission is a crime in most countries, for example under the US Computer Fraud and Abuse Act, the UK Computer Misuse Act and Sri Lanka’s Computer Crimes Act No. 24 of 2007. Scan your own site, or one where you hold written permission. Passive tools that only read public information are safe on any site you own. Active scanners send attack-style traffic, so use a staging copy where you can, and warn your host if the site is on shared hosting.

Step 2: Run a passive check

A passive check never sends attack traffic. It maps what an attacker can see: subdomains you forgot, the technology and versions in use, DNS records and email security. Forgotten subdomains and old test sites are among the most common real findings.

Free website security check: subdomains, technology, SSL, DNS and email in one pass.
Subdomain finder and website technology checker.

Step 3: Check headers, TLS and email authentication

These are quick wins that scanners and attackers both look at first.

Security headers checker: HSTS, Content-Security-Policy, X-Frame-Options and more.
SSL certificate checker: expiry, chain and protocol problems.
Email spoofing checker: SPF, DKIM and DMARC, so nobody can send mail as your domain.
DNS record lookup: check for dangling records that point at services you no longer use.

Step 4: Run an active scanner on a copy

An active scanner crawls your site and tries common attacks. A few well-known free options:

Free website vulnerability scanners compared
Tool	What it does	Good to know
ZAP	Crawls the site, finds common web flaws such as XSS and injection, and has a passive baseline mode.	The baseline mode is safe on production. A full active scan belongs on staging.
Nikto	Checks the web server for dangerous files, old versions and misconfigurations.	Noisy. Expect a lot of low-value results.
Nuclei	Runs community templates that look for known vulnerabilities and exposed panels.	Only as good as the templates. Great for known CVEs.
WPScan	Checks WordPress core, plugins and themes against known vulnerabilities.	WordPress only. Needs an API token for full data.

Run scans outside busy hours, rate-limit them, and expect them to submit forms and create test data. Never point an active scanner at someone else’s site.

Step 5: Check your dependencies

Many real compromises come from a known flaw in a plugin, theme or library that was never updated. List what you run and check each against its vulnerability database: your CMS’s plugin directory notes, GitHub security advisories, and package tools such as npm audit for JavaScript projects. Update, or remove what is abandoned.

Step 6: Sort the results

A scan can return hundreds of lines. Fix in this order: anything critical or high that is reachable without logging in, then anything that exposes data, then the rest. Many findings are informational and do not apply to your setup, so do not chase every line. If you want a person to sort them for you, a manual audit does exactly that.

What a scan finds, and what it cannot

What website vulnerability scans find and miss
A scan usually finds	A scan usually misses
Missing or weak security headers	Broken access control: one customer reading another customer’s data
Outdated software with known vulnerabilities	Business-logic flaws, such as skipping a payment step
Exposed files, backups and admin panels	Chained issues that are harmless alone and serious together
Common injection and XSS patterns in forms	Flaws that need a login, several steps or knowledge of your app
Expired or misconfigured certificates	Weak password-reset and session handling that looks normal to a tool

The classic example: change /orders/1042 in a link to /orders/1041 and see someone else’s order. A scanner sees a normal page. A person sees the problem. That gap is why manual and automated testing are not the same thing.

Step 7: Test the logic by hand

When the scan is clean and the dependencies are current, the remaining risk is in how your app behaves. This is where a manual security audit pays for itself: a person logs in as each role, tries the actions they should not be able to do, and writes up every issue with the evidence and the fix.

Free check: start with the passive scan. Nothing touches your site.
Circuit, $49 one-time: a person tests your site by hand and sends a full written report. See a sample report.
Signal, $147 every 3 months: adds fixes for the high and critical issues, re-tests every 6 months and weekly checks.

Details and the 14-day money-back guarantee are on the pricing page.

Frequently asked questions

How do I scan my website for vulnerabilities?

Start with a passive check that lists your subdomains, technology, DNS and email records, then test your security headers and SSL certificate. After that, run a free active scanner such as ZAP against a staging copy and check your plugins and libraries for known issues. Finish with a manual test for access-control and logic flaws, which scanners cannot find.

Is it legal to scan a website for vulnerabilities?

Only if you own it or have the owner’s written permission. Scanning a site you do not own is illegal in most countries, for example under the US Computer Fraud and Abuse Act, the UK Computer Misuse Act and Sri Lanka’s Computer Crimes Act No. 24 of 2007, even if you mean no harm. A passive check that only reads public information is different from an active scan that sends attack traffic.

What is the best free website vulnerability scanner?

There is no single best one. ZAP is a widely used free, open-source scanner with a safe passive baseline mode. Nikto checks the web server, Nuclei runs community templates for known issues, and WPScan checks WordPress. Bug Circuit’s free check is a passive scan of what attackers can see from the outside. Use more than one, and expect all of them to miss logic flaws.

Does a clean scan mean my website is secure?

No. A scanner finds known patterns: missing headers, outdated software, exposed files and common misconfigurations. It cannot understand your business logic, so it misses broken access control, such as a customer reading another customer’s order by changing a number in a link. A clean scan is a good sign, not proof.

What is the difference between a vulnerability scan and a penetration test?

A vulnerability scan is automated and lists possible weaknesses. A penetration test is done by a person who tries to use the weaknesses the way an attacker would, to show which ones are real and how serious. Scans are cheap and frequent, pen tests are deeper and less frequent. Most sites need both.

How often should I scan my website?

Scan after every significant change, and at least monthly for a site that takes payments or holds customer data. Automated weekly checks catch new problems such as an expired certificate or a newly disclosed plugin vulnerability. Add a manual test at least once a year.

Can a scanner find SQL injection and XSS?

Often, yes, for common patterns in forms and URL parameters. Scanners are good at spotting the obvious cases and weaker at problems that need a logged-in user, several steps or knowledge of how your app works. Use them for coverage and a person for depth.

Keep reading

Is my website hackable?A self-check of your real attack surface.Manual vs automated penetration testingWhat a person finds that scanners miss.Website security checklist before launchWhat to check before going live.All free security toolsHeaders, SSL, DNS, subdomains and more.Small business cyber security audit checklistA checklist you can work through yourself.Free tool: Next.js Vulnerability CheckerEnter a site and see its Next.js version and every published security advisory for it.Free tool: PHP Version CheckerFind the PHP version a site runs, see if it is still supported and which security fixes it is missing.

Start with the free passive check

See what attackers can see about your website in seconds. No login, no card, nothing touches your site.

Ready for the full manual audit? See pricing