Professional DAST scanner that crawls your web application and tests for OWASP Top 10 vulnerabilities. No external tools, no API keys, no complex setup. Just paste a URL and get results.
Most security scanners cost thousands per year, require complex installation, or depend on external services. Small teams and individual developers are left choosing between manual testing and tools they can't afford. By the time a vulnerability is found manually, it's often too late. The app is already in production.
Reflected + DOM-based XSS, POST form injection, SQL injection (GET and POST), command injection, and path traversal/LFI.
Certificate validity, expiry warnings, protocol version detection, cipher strength, and HTTPS enforcement checks.
Checks 7 critical headers: HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and more.
Detects exposed .env files, .git directories, source maps, private IPs, email addresses, and stack traces.
Deep crawling (3 levels, 30 URLs), automatic SPA detection with headless browser, subdomain enumeration via CT logs, and tech fingerprinting.
Export results as professional PDF, structured JSON (for CI/CD), or self-contained HTML reports to share with your team.
Enter any public HTTP/HTTPS URL. SSRF protection blocks private and local addresses automatically.
The engine crawls up to 30 pages (depth 3), discovers forms and parameters. Automatically detects SPAs and uses a headless browser for JavaScript-rendered content.
24 security modules run sequentially. Findings stream to your browser live, no waiting for the full scan to finish.
Download a PDF report, export JSON for automation, or save an HTML report. Each finding includes specific remediation steps.
Validate your app before deployment. Catch missing headers, exposed files, and injection points without learning Burp Suite.
Quick recon on targets. Get a baseline assessment in under 60 seconds before diving into manual testing.
JSON export with exit codes for CI/CD pipelines. Automate security checks on every deploy.
Learn about web vulnerabilities hands-on. See real findings with explanations and remediation guidance.
Findings map directly to OWASP 2021 categories. 8 out of 10 categories covered.
You must have explicit authorization to scan a website. Scanning systems you don't own or have permission to test may violate laws like the Computer Fraud and Abuse Act. Only scan your own applications or those you've been authorized to test.
No. Results exist only in memory during the scan and are streamed directly to your browser. Once you close the tab, they're gone. There's no database, no user accounts, and no data retention on the server.
Yes. WebArmor automatically detects SPAs (React, Angular, Vue, Next.js, Nuxt) and uses a headless browser (Chromium via Playwright) to render JavaScript, discover routes, forms, and API calls. Non-SPA sites use the faster HTTP-only crawler.
100% detection rate against known planted vulnerabilities in controlled tests, with 0 false positives on static pages. On real-world sites, accuracy is 91%+. The remaining variance comes from CDN edge-node inconsistencies (e.g., Akamai returning different headers).
WebArmor only sends read-only requests (GET with query parameters). It never sends PUT, DELETE, or destructive POST requests to your target. However, security tools like WAFs may flag the scan traffic. The scanner identifies itself with a standard Chrome User-Agent.
Yes. Export results as JSON for programmatic processing. You can hit the API endpoint directly (POST /api/scan) and poll the SSE stream for results. Full CLI mode with exit codes is planned.
Stored XSS (needs multi-step sessions), business logic flaws, authentication bypass, XXE, and deserialization attacks. These require manual testing or authenticated scanning, both planned for future releases.
Paste a URL and get a full security assessment in under 60 seconds. Free, no signup required.
Launch Scanner