Free Website Security Scan
Free tool
Passive scan of your live URL in 60 seconds. Checks TLS, security headers, CSP and cookies, plus CORS and SPF/DKIM/DMARC on paid plans, with step-by-step fixes for each finding.
- Full security assessment
- Detailed security report
- Actionable recommendations
- Risk severity scoring
No credit card requiredRead-only, no exploitationNo setup or code required
Used by 5,000+ developers and engineering teams
What to do with your results
- Prioritize high-impact fixes (HSTS, CSP baselines, cookies) first
- Assign owners and track remediation to completion
- Set up recurring scans to maintain posture after fixes
What this scan covers
- HTTP security headers and CSP policy quality
- TLS/HTTPS configuration and certificate health
- Cookies (HttpOnly/Secure/SameSite) and basic CORS posture
How Barrion verifies this
Barrion runs a passive, read-only sweep against your public surface. We fetch your site over HTTPS, follow redirects, and inspect the response headers, TLS handshake, and certificate chain the same way a browser would. Nothing is submitted, nothing is exploited, and no authenticated routes are touched.
On paid plans we also resolve DNS records (MX, SPF, common DKIM selectors, DMARC, CAA) and check CORS headers. Every scan checks cookie flags and Content Security Policy directives against the OWASP secure-defaults profile. Each finding is normalized to a severity and mapped to a concrete configuration change so you know exactly what to edit.
Because the scan is fingerprint-based rather than intrusive, it's safe to run against production on every deploy. Schedule it weekly or daily from your dashboard to catch drift from CDN changes, new third-party scripts, or accidental header removals before they reach users.
Why regular scans matter
Websites change frequently. Deploys, CDN tweaks, and third-party scripts can introduce drift. Regular scanning catches regressions early so you can fix issues before they become incidents. Use Barrion's continuous monitoring to detect any regressions.
Tool-specific questions
What is a website security scan?
A website security scan checks your live site and public footprint for common vulnerabilities and misconfigurations: security headers, TLS/HTTPS, cookies, CORS, email (SPF/DKIM/DMARC), and exposure risks. Barrion runs production-safe (passive) scans with no code or server access. You get a detailed report with step-by-step fixes in under 60 seconds.
Is this security scan intrusive or harmful?
No, our security scan is completely non-intrusive and safe. All checks are passive - we only perform read-only analysis of publicly accessible responses and headers. We never attempt to exploit vulnerabilities, access private data, or perform any actions that could harm your website or infrastructure.
How long does a comprehensive security scan take?
Most scans complete within 60 seconds for single-site checks. Complex websites with multiple pages may take 2-3 minutes. Our scanning is optimized for speed while maintaining thorough coverage of all security aspects.
Does this replace a professional penetration test?
No, this automated scan complements but doesn't replace professional penetration testing. Use it for regular security monitoring, initial assessments, and continuous security validation. Combine with manual testing for comprehensive security coverage.
What types of vulnerabilities can this scan detect?
Our scan detects configuration issues, security header problems, TLS/SSL misconfigurations, cookie security issues, CORS problems, and basic application vulnerabilities. It covers the most common web security issues that affect the majority of websites.
What does 'passive scanning' mean and what specific checks are performed?
All our scans run passively, meaning we only analyze publicly available information without attempting any active exploitation. Our comprehensive security testing covers TLS/HTTPS configuration and certificate health, security headers (HSTS, CSP, X-Frame-Options, etc.), CORS policy analysis, cookie security (HttpOnly, Secure, SameSite), email security (SPF, DKIM, DMARC), DNS security (CAA records), network exposure assessment, and application vulnerability detection. Every check is designed to be safe and non-intrusive.
How often should I run security scans?
Run scans after any major changes, deployments, or security updates. For ongoing monitoring, weekly scans are recommended. Use Barrion's continuous monitoring for scheduled scans, up to daily, and instant alerts when new issues are detected.
Can I use this for compliance auditing?
Yes, our scan results can help with compliance requirements like PCI DSS, HIPAA, and SOC 2. The reports provide evidence of security controls and can identify gaps in your security posture. Supplement with internal assessments for complete compliance coverage.
What should I do with the scan results?
Prioritize high-impact issues first (HSTS, CSP, cookie security), assign remediation tasks to team members, track progress to completion, and set up recurring scans to maintain security posture. Use our actionable recommendations for efficient fixes.
Does the scan work with all types of websites?
Yes, our scan works with any publicly accessible website including static sites, dynamic applications, e-commerce platforms, and web services. It analyzes the security configuration regardless of the underlying technology stack.
Why Barrion
Built for the engineers who already have enough to fix.
Speed
Fast results
Instant analysis with a detailed report. You see findings as the scan runs, not after.
Coverage
Comprehensive checks
The full passive scan runs 18 checks on the free plan, covering TLS, headers and cookies. Paid plans run 35+ and add CORS, DNS, email auth and more.
Action
Step-by-step fixes
Every finding ships with the exact remediation step for your framework. Hand it to the engineer who owns the surface.
Other tools
More free checks, for the rest of your surface.
Pre-Pentest Security Scan
Passive scan that catches the misconfigurations a pentester finds first. Use it before a manual engagement to clear the easy issues.
Security Compliance Checker
Run general security checks relevant to PCI DSS, HIPAA, SOC 2, ISO 27001 and GDPR. Findings aren't mapped to specific requirements.
WAF Checker
Detect which WAF or CDN sits in front of your site from the signatures in its response. Passive, no attack payloads.
Security Headers Test
Check your website's HTTP security headers configuration
TLS/SSL Security Checker
Validate your SSL/TLS configuration and certificate setup
Content Security Policy (CSP) Checker
Analyze your CSP for unsafe directives and strengthen your policy with best practices.
FAQ
Frequently asked.
What is Barrion?
Barrion runs continuous, agentic AI penetration tests of web applications and APIs. AI agents test your app the way an attacker would, safely, on a schedule or on demand. Findings are checked against the live app before they're reported, and tracked across runs as new, still open, resolved or regressed. From Standard level up, a security engineer reviews each report. Barrion AB is based in Gothenburg, Sweden. A free passive scan is the quickest way to start.
How safe is Barrion to use for security testing?
AI pentests send real test requests, so they're rate-limited and non-destructive, and you approve the exact scope before a single request goes out. You can point them at staging too. The free passive scan only reads your live app. It never submits forms, brute-forces endpoints or touches anything that changes state, so it's safe to run against production.
What types of security issues does Barrion identify?
AI pentests look for the issues an attacker could exploit, like SQL injection, cross-site scripting and broken access control. Findings are checked against your live app, and confirmed ones come with the request and response that prove them. Anything we couldn't confirm is clearly marked and capped in severity. The passive scan catches misconfigurations in TLS and HTTPS, security headers, cookie flags, CORS policy, DNS records, email authentication (SPF, DKIM, DMARC) and network exposure.
What specific security checks does Barrion perform?
Barrion covers two surfaces. AI pentesting is the active part: specialist agents chain requests to find exploitable flaws such as SQL injection, cross-site scripting and broken access control. Findings are checked against your live app, and confirmed ones come with the request and response that prove them. The passive scan is read-only and safe to point at production. On paid plans it runs 35+ checks (18 on the free plan): transport security (HTTPS, HSTS, TLS version, cipher suites, certificate expiry, hostname and chain validity, OCSP stapling), HTTP response headers (Referrer-Policy, Permissions-Policy, X-Content-Type-Options, Content-Type, server information disclosure), CSP and framing (Content-Security-Policy, bypass detection, Trusted Types, X-Frame-Options), cross-origin policy (COOP, COEP, CORP and the full CORS header set), cookie flags and anti-CSRF tokens, mixed content, vulnerable JavaScript libraries, DNS records including DNSSEC and CAA, email authentication (SPF, DKIM, DMARC), open ports and subdomain takeover. Findings from both are ranked by severity and come with step-by-step remediation.
Will my auditor or enterprise customers accept the pentest report?
The report maps every finding to OWASP WSTG, a security engineer reviews it from Standard up and signs it off from Deep up, and a free retest shows what you fixed. Teams use it as evidence for SOC 2, ISO 27001 and NIS2 work. Whether it's accepted is up to your auditor.
How often does Barrion test my app?
Continuously or on demand. On the Business plan you save a pentest and it reruns daily, weekly, monthly, quarterly, every six months, yearly or on your own rhythm. On any plan you can start a pentest or a passive scan on demand. A passive scan also runs on a schedule and alerts you when something new shows up.
Is Barrion suitable for security testing of all business sizes?
Yes. Solo developers often start with the free passive scan and a single pentest. Teams with several apps run pentests on a schedule, and it fits alongside the tools you already run.
How does Barrion handle data security and privacy during security testing?
Passive scans are read-only: they only look at what your app already exposes publicly. For AI pentests we keep the findings in your report, and confirmed findings include the request and response behind them, so you can review and reproduce them. Test credentials you add are encrypted. Barrion is hosted in Sweden, data is stored in the EU and AI processing runs in the EU. Our trust page lists every subprocessor. Pentests are rate-limited and only run inside the scope you approve.
What if I'm not satisfied with Barrion's security testing service?
You can cancel anytime in the dashboard, and paid plans carry a 14-day refund window from the first charge. If something isn't right, contact us and we'll make it work for your team.
How does Barrion help with SOC 2, ISO 27001, NIS2, and other compliance frameworks?
Barrion's pentest reports come as PDF, XLSX and JSON, mapped to all 97 OWASP WSTG test cases, with engineer review from Standard up, sign-off from Deep up and a free retest after fixes. Teams use them as evidence that supports SOC 2, ISO 27001, PCI DSS and NIS2 work. Whether a report is accepted is up to your auditor or customer.
Anything else? Email contact@barrion.io.
Keep it covered
Fix it once, then watch it stay fixed.
A pentest shows what is exploitable today. A scheduled passive scan re-checks this tool's results and alerts you when a deploy undoes the fix.
What you get for free
18 core security checks via this tool, passive scans, step-by-step remediation, security score on every result.
What Essential adds from €199/mo
Pentest credits every month, +17 advanced checks, weekly passive scans, email alerts and audit-ready PDFs for SOC 2 / ISO 27001 / PCI.