README.md

---
title: "FreeWeb Security SCAN — Free Web Security & AI-Visibility Check"
emoji: 🛡
colorFrom: purple
colorTo: indigo
sdk: gradio
sdk_version: 5.49.1
app_file: app.py
pinned: false
license: other
hf_oauth: true
hf_oauth_scopes:
  - email
short_description: "Free web security, SEO & AI-visibility (GEO) scan"
tags:
  - security
  - cybersecurity
  - web-security
  - vulnerability-scanner
  - security-headers
  - spf-dmarc
  - dns
  - dnssec
  - tls
  - seo
  - geo
  - aeo
  - ai-visibility
  - llm-crawler
  - owasp
  - nist
  - non-intrusive
  - gradio
---

# 🛡 FreeWeb Security SCAN — Free Web Security & AI-Visibility Check

**Enter a domain and in about 10 to 25 seconds** get a **free, non-intrusive (read-only)** assessment of your website's **security, SEO, and AI visibility (GEO)**. No login, no install, no credit card.

> Service: **QuantID** · Engine: **CHITOS** · Scanning logic runs on a private backend.

👉 **Type a domain (e.g. `example.com`) in the box above and press Scan.**

---

## ⚡ What it does

- **Free instant scan** reads one home page and summarizes security, SEO, and AI-visibility grades plus the most urgent issues.
- **Non-intrusive and non-destructive** reads only publicly exposed responses, with no attack, no load, and no login (read-only).
- **Professional report** with an overall grade, score bars, a full checklist (passing items included), and prioritized actions.
- **English and Korean** with browser-language auto-detection and an instant toggle (no re-scan needed).

---

## 🔎 What gets checked

### 1) Web security hygiene
Security response headers (CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, HSTS), forced HTTPS and HSTS preload, cookie flags (HttpOnly, Secure, SameSite), CORS policy, CSP quality, server and tech-stack exposure, **TLS certificate validity**, sensitive and backup file exposure (`.env`, `.git`, and more), `security.txt`, response compression, and cache policy.

### 2) Email security (deep)
**SPF** (policy and DNS lookups), **DKIM** signing, **DMARC** policy (monitor / quarantine / reject), **BIMI**, **MTA-STS**, and **TLS-RPT**. Diagnoses spoofing, phishing, and spam-folder risk.

### 3) DNS and domain (deep)
**DNSSEC**, **CAA** (certificate issuance control), **MX**, and **NS redundancy**.

### 4) Site-wide security consistency (deep)
HTTPS coverage across pages, per-page missing security headers, **mixed content**, **external-script supply chain (missing SRI)**, and sensitive-pattern exposure.

### 5) SEO foundations
Title, meta description, canonical, structured data (Schema), OG tags, mobile viewport, indexability (noindex), content language, image alt-text, sitemap, and robots.txt.

### 6) AI visibility (GEO)
Reachability of **9 generative-AI and search crawlers** (Googlebot, Bingbot, Naver Yeti, GPTBot, ClaudeBot, PerplexityBot, OAI-SearchBot, ChatGPT-User, Applebot). For ChatGPT, Claude, or Perplexity to read and **cite** your site, their crawlers must be able to get in first.

---

## 🧭 How to use it (a 3-step funnel)

1. **① Free Instant Scan** just enter a domain. Open to anyone, for any target.
2. **② Domain-Verified Deep Scan** sign in with a **Hugging Face account registered on your company or organization domain email** to confirm ownership, then unlock full-site pages, email and DNS checks, self-contradiction detection, and a downloadable report. Still non-intrusive.
3. **③ In-Depth Consultation** real vulnerabilities (SQL injection, file upload, auth bypass, IDOR) and AI-era deep diagnosis, performed under **written authorization**. Areas: **Web Service · AX Infra · AI Model · AI Agent (AX-RAY)**.
4. **④ Standards & Checklist** a mapping to domestic and international security and AI-safety standards, plus a self-check list.

---

## 🚨 Why now — the rise of agentic attacks

AI agents now break in on their own. In 2026 the open-source AI penetration agent **ARTEX** was turned on real targets, hitting **2,250+ Microsoft 365 tenants**, breaching e-commerce order databases, and automating recon-to-exfiltration against **unpatched internet-facing systems worldwide**. The common entry point was weak web and infrastructure hygiene. Attacks are automated now, so defense must be too. FreeWeb Security SCAN diagnoses **web, infrastructure, AI models, and AI agents** together.

---

## 📚 Standards we align with

**International**: OWASP Top 10, OWASP Top 10 for LLM Apps, OWASP ASVS, MITRE ATT&CK and ATLAS, NIST AI RMF, NIST SSDF, ISO/IEC 27001, ISO/IEC 42001, EU AI Act, Google SAIF.
**Regional**: financial-sector AI-agent security criteria, national web and secure-coding guides, and information-security management frameworks.

> Internal methodology, thresholds, and attack sets are confidential. This page shows only the mapping and the capability against public standards.

---

## ❓ FAQ

**Is it really free?**
The first-step scan is free for anyone, with no login, card, or install.

**Will it harm my site?**
No. It is non-intrusive and non-destructive (read-only). It performs no attacks, no load, and no form submissions, and reads only publicly exposed responses and headers.

**What does it check?**
Security headers, HTTPS/HSTS, cookies, the TLS certificate, SPF/DKIM/DMARC/BIMI/MTA-STS, DNSSEC/CAA, mixed content and SRI, reachability of 9 AI crawlers, and SEO fundamentals.

**What is AI visibility (GEO)?**
Whether generative-AI assistants and search crawlers can read your site and cite it in their answers. A common issue is a robots.txt that allows everyone while a firewall quietly blocks AI bots.

**How do I run a deep scan?**
Sign in with a Hugging Face account registered on the target domain's email. Ownership is confirmed and the full-site report opens. Unauthorized deep scans of other sites are not allowed.

**Do you test for real vulnerabilities (intrusion)?**
Active testing is provided only within the owner's written authorization, via the in-depth consultation step.

**What should I do with the results?**
Fix High items first, then Advisory, then Low. For real vulnerabilities and AI-agent threats, continue to the in-depth consultation.

---

## 🔐 Privacy and safety

- Every check is **non-intrusive and non-destructive (read-only)** and does not affect the target.
- Deep-scan ownership is judged only by your account's **verified email domain**.
- Results reflect the time of measurement, and the internal methodology is not disclosed.

---

*Non-intrusive and non-destructive · no unauthorized deep scans of other sites · active testing only after domain verification and authorization · Service: QuantID · Engine: CHITOS.*