# WebGuard AI

> WebGuard AI is an online website security scanner. In under a minute it runs a passive audit of any website — SSL/TLS certificate, HTTP security headers, DNS and email authentication (SPF, DKIM, DMARC), exposed files, subdomains and vulnerable software (CVEs) — then writes a plain-language report with a prioritised fix plan.

WebGuard AI (https://www.webguardai.com) is available in English, French and Spanish. It is a passive scanner: it only reads what a site exposes publicly and sends no attack payloads, so it is safe on production sites. It complements, but does not replace, a penetration test (it does not test for SQL injection, XSS or authentication flaws).

## Key facts

- Scan time: 10 to 40 seconds, nothing to install, no server access needed
- Output: security score out of 100, issues ranked by severity (critical, high, medium, low), exact fix for each issue, AI-written report, PDF export
- Free: up to 5 scans per day without a credit card (score, every issue listed, fixes for the top 3, short AI summary)
- Paid, one-time, no subscription: full report €12, 5 reports €49, 20 reports €149; credits never expire
- Only scan sites you own or are authorised to test

## The 12 checks

- SSL/TLS certificate: validity, expiry date, HTTPS redirect and HSTS
- HTTP security headers: Content-Security-Policy, HSTS, X-Frame-Options, Referrer-Policy, Permissions-Policy, COOP/COEP/CORP
- DNS and email: SPF, DKIM, DMARC and DNSSEC against domain spoofing
- Exposed files: .env, .git, backups and admin pages left online
- Subdomains from Certificate Transparency logs, with subdomain takeover detection
- Vulnerable and end-of-life software with known CVEs (Apache, nginx, PHP, WordPress, jQuery…)
- Cookie flags: Secure, HttpOnly, SameSite
- CORS misconfigurations: wildcard, reflected or null origin
- Secrets in page source: API keys and tokens
- robots.txt and security.txt (RFC 9116)
- Subresource Integrity (SRI) on third-party scripts
- Domain WHOIS and technology fingerprinting

## Pages

- [Website security scanner (English)](https://www.webguardai.com/en): free website security check
- [Test de sécurité de site web (Français)](https://www.webguardai.com/fr): scanner de vulnérabilités et audit de sécurité gratuit
- [Escáner de seguridad web (Español)](https://www.webguardai.com/es): análisis de seguridad web gratis
- [Website vulnerability scanner](https://www.webguardai.com/en/website-vulnerability-scanner): Scan your website for vulnerabilities online for free: outdated software with known CVEs, exposed files, weak SSL, missing security headers and email spoofing risks, with fixes.
- [SSL certificate checker](https://www.webguardai.com/en/ssl-checker): Check your SSL certificate online for free: validity, expiry date, issuer, HTTPS redirect and HSTS. Find SSL/TLS problems before your visitors see a browser warning.
- [Security headers checker](https://www.webguardai.com/en/security-headers): Test your HTTP security headers for free: Content-Security-Policy, HSTS, X-Frame-Options, Referrer-Policy, Permissions-Policy, COOP, COEP and CORP, with a score and the exact fix.
- [SPF, DKIM & DMARC checker](https://www.webguardai.com/en/email-security): Check your domain SPF, DKIM and DMARC records and DNSSEC for free. Find out if attackers can send phishing emails using your domain name, and how to fix it.
- [WordPress security scanner](https://www.webguardai.com/en/wordpress-security): Scan your WordPress site for free: outdated WordPress version with known CVEs, exposed wp-config.php source, database dumps, weak headers and SSL. Passive check, no plugin to install.
- [Pricing](https://www.webguardai.com/en/pricing): free scan, €12 full report, credit packs
- [Terms](https://www.webguardai.com/en/terms), [Privacy](https://www.webguardai.com/en/privacy), [Refunds](https://www.webguardai.com/en/refund), [Contact](https://www.webguardai.com/en/contact)

## FAQ

### How can I check my website security for free?

Enter your site address on WebGuard AI and start the scan. In 10 to 40 seconds the scanner checks 12 areas — SSL/TLS certificate, HTTP security headers, SPF/DKIM/DMARC, exposed files, subdomains, vulnerable software and more — and gives a security score out of 100. Free scans: up to 5 a day, no credit card required.

### What is a passive website vulnerability scanner?

A passive scanner only looks at what a website exposes publicly, the way a visitor would: certificate, HTTP headers, DNS records and reachable files. It sends no attack payloads, so it is safe to run on a live production site. It does not replace a penetration test, which looks for SQL injection, XSS or authentication flaws.

### Which security checks does WebGuard AI run?

SSL/TLS and HSTS, nine HTTP security headers with quality checks (CSP, X-Frame-Options, Referrer-Policy…), SPF, DKIM, DMARC and DNSSEC, exposed files such as .env or .git, subdomain takeover, outdated software with known CVEs, cookie flags, CORS, secrets in page source, robots.txt and security.txt, and Subresource Integrity.

### Can the scan harm my website?

No. The tool only reads what your site makes public, like a visitor. It sends no attack payload and makes a small number of ordinary requests.

### Can I scan a website I do not own?

You must own the website or have its owner's permission. You are responsible for the scans you run.

### How much does a full website security audit cost?

The overall score and the list of every issue are free, with fixes for the 3 most serious. A full report — every issue with its fix, the AI-written report and the PDF export — costs €12, or €49 for 5 reports and €149 for 20. One-time payment, no subscription, and credits never expire.

### How do I improve my website security score?

The fixes with the biggest impact are usually: serve everything over HTTPS with HSTS, add a Content-Security-Policy, publish SPF, DKIM and DMARC records, remove sensitive files (.env, .git) from the web root and update outdated software. The WebGuard report ranks every fix by urgency.