Skip to content
TasScan
Free scan

Website Security Scanner

Free Security Check

A limited, non-intrusive look at how your domain presents itself to the internet. It usually takes a minute or two, needs no account and sends only the small, fixed set of read-only requests listed below.

Free Security Check

A limited, read-only check of a public hostname: DNS records, a TLS handshake, up to four HTTP requests and a technology fingerprint. It is limited and non-intrusive, and it is not a full scan. The result is kept for a limited time (24 hours by default, set by the platform operator); the result shows its exact expiry and is then deleted.

A public hostname only — no IP addresses, no paths.

Rate limits: 3 checks per visitor per hour and 1 per domain every 10 minutes. Domain owners can opt out; see exactly what is sent and /security.

Your score, severity counts and headline observations will appear here. Detailed findings, evidence and remediation are available in the portal after verifying the domain.

What happens

Limited and read-only, and exactly this

The free check performs this small, fixed set of read-only requests against a public hostname you enter. Anything deeper (Standard, Deep and Custom scans, port and service checks, API scope, crawling) requires verified ownership and an authorization record. At most 1 request per second, 20 requests and 60 seconds per check, one connection at a time. Rate limits: 3 checks per visitor per hour and 1 per domain every 10 minutes.

What our scans do

  • DNS look-ups through the platform resolver (records such as A, AAAA, MX, NS, TXT, CAA, SPF, DMARC, DNSSEC); these query DNS, not your web server, and are capped at 60 queries per check
  • A few TLS handshakes to port 443 to read the protocol versions, cipher and certificate (no application data is sent)
  • Up to four HTTP requests: GET https:// and GET http:// of the landing page (redirects followed up to 4 hops), one GET with a fake Origin header (https://tasscan-cors-probe.invalid) to test origin reflection, and one GET of a random non-existent path to look at the error page
  • A technology fingerprint read from the landing page and headers already fetched (no extra request)
  • Return a score, severity counts, short finding titles, technology names and a TLS summary

What they never do

  • Crawl the site, submit forms, send payloads, guess credentials or probe for injection
  • Scan ports or identify services
  • Run any Standard, Deep or Custom check
  • Keep evidence, URLs or page content in the stored result

The result is kept for a limited time (24 hours by default, set by the platform operator); the result shows its exact expiry and is then deleted.

Anonymised means the visitor: your IP address is stored only as a keyed hash that drives the rate limit, and nothing links a check to an account. The checked domain name is stored with the result, and the result contains only the score, severity counts, short finding titles, technology names and a TLS summary: no evidence, URLs or page content.

Domain owners can opt out of the free check: see the Security page. The score is explained on the score methodology page, and the scanner identity section shows how our requests identify themselves.