See what your site tells a stranger.
Enter a URL and we will look at it the way a visitor's browser does: one request for the page, then the scripts it loads. No signup, no agent to install, and nothing your own browser would not already have fetched.
What we look at, and what we will not do
Your connection
HTTPS, whether http visitors get redirected, and how long browsers are told to remember it.
Your response headers
The content policy, framing protection, referrer leakage, and what your server announces about itself.
Your cookies
Whether a session cookie can travel unencrypted, be read by scripts, or be sent from another site.
Your client code
The scripts your page loads, checked for database keys, payment keys, and model API keys that should never leave your server.
This is a passive scan
We request the page and the scripts it references, and nothing else. We do not guess at hidden paths, submit forms, try credentials, or send anything designed to break the site. Our requests identify themselves as VibeZero-Scanner in your access log. We will not scan a private or internal address, and you should only scan sites you own or are authorized to test.