No fluff • No enterprise nonsense

Find real security issues before attackers do.

We run passive security checks and explain the findings in plain English — with clear fixes, not vague advice.

$ scanner check example.com
✓ TLS 1.3 negotiated, cert valid (54 days)
✗ No Content-Security-Policy header
✗ No Strict-Transport-Security header
! Port 8080 open to the internet
! Port 8443 open to the internet
done in 6.4s — risk score 42/100

What we look at

Just the things that actually matter. No fluff, no false positives.

HTTP security headers

Browsers expect specific headers to defend against script injection, clickjacking, and session theft. We check the standard set.

$ curl -I https://example.com
HTTP/2 200
content-type: text/html
strict-transport-security: ?
content-security-policy: ?

TLS / certificates

Cert validity, expiration, and which TLS versions you negotiate. Old protocols are a quiet but real risk.

$ scanner tls example.com
TLS 1.3 ✓
TLS 1.2 ✓
TLS 1.1 — outdated
cert expires in 54 days

Open ports

Anything beyond 80 and 443 is worth a look. Admin panels, databases, dev servers — these are the easiest wins for an attacker.

$ scanner ports example.com
22/tcp   ssh
80/tcp   http
443/tcp  https
8080/tcp http-alt — exposed

Here's what you'll get

A risk score, top issues with severity, and a step-by-step fix guide. Plain language, no jargon.

42/100

Domain

yourstartup.com

Open dev ports plus a complete absence of standard security headers — together a realistic path for a targeted attacker. TLS is solid.

Top issues

highDev ports 8080 and 8443 exposed to the internetports
highNo Content-Security-Policy headerheaders
mediumNo Strict-Transport-Security (HSTS) headerheaders
infoTLS certificate expires in 54 daystls

Each issue ships with a one-line attack scenario, business impact, and exact remediation steps you can paste into your config.

How it works

  1. 01

    Add and verify your domain.

    One-time DNS TXT record or file upload — same as Google Search Console. Takes about a minute.

  2. 02

    We run passive scans.

    Ports, headers, TLS. No exploitation, no auth probing — nothing that should worry your security team.

  3. 03

    AI explains what to fix.

    Plain-English business impact and step-by-step remediation, ranked by severity.

Pricing

Start free. Buy a credit pack when you need more scans — no subscription, credits never expire.

Free

$0

3 scans / week

Starter

$9

20 scans

Growth

$29

100 scans

Bulk

$99

500 scans

One-time · $29

Deep Audit — full report, emailed to you

Order →
See all packs →

Common questions

Is this safe to run? Will you break anything?+
Yes, safe. We run only passive checks: looking up open ports, fetching public headers, inspecting your TLS handshake. We don't probe authentication, send malicious payloads, or generate volumetric traffic. The footprint is similar to a normal browser visit plus a port scan.
What's the difference between the free scan and Deep Audit?+
The free scan gives you a risk score and the top 5 issues with fixes. The Deep Audit ($29 one-time) includes an executive summary, business-impact narrative, up to 10 ranked issues, a remediation playbook, and compliance notes — emailed to you and viewable from your account. Print or export to PDF to share.
Do I need to own the domain I'm scanning?+
Yes. Every scan of a real domain requires one-time ownership verification (DNS TXT record or file upload — the same model as Google Search Console). Anonymous visitors can try our demo scan against a subdomain we operate ourselves. This is the primary reason CrabScan is a monitoring tool for domain owners, not a general vulnerability scanner.
What happens to my scan results?+
Scans and audits are stored against your account and viewable only when you're signed in. To share a report externally, print or export it to PDF from the report page. We never sell data, never share with third parties, and you can request deletion any time.
How do the packs work?+
You buy a pack once and get a bundle of scan credits — 20, 100 or 500. Credits never expire; use them whenever you want. Nothing renews automatically, so there's nothing to cancel. Free tier still gives you 3 scans per week.

Ready to see what's actually broken?

Try the demo scan in about 30 seconds — or sign in and verify your own domain in about a minute.

Scan your siteSee pricing