A newer version of the Gradio SDK is available: 6.30.0
title: FreeWeb Security SCAN — Free Web Security & AI-Visibility Check
emoji: 🛡
colorFrom: purple
colorTo: indigo
sdk: gradio
sdk_version: 5.49.1
app_file: app.py
pinned: false
license: other
hf_oauth: true
hf_oauth_scopes:
- email
short_description: Free web security, SEO & AI-visibility (GEO) scan
tags:
- security
- cybersecurity
- web-security
- vulnerability-scanner
- security-headers
- spf-dmarc
- dns
- dnssec
- tls
- seo
- geo
- aeo
- ai-visibility
- llm-crawler
- owasp
- nist
- non-intrusive
- gradio
🛡 FreeWeb Security SCAN — Free Web Security & AI-Visibility Check
Enter a domain and in about 10 to 25 seconds get a free, non-intrusive (read-only) assessment of your website's security, SEO, and AI visibility (GEO). No login, no install, no credit card.
Service: QuantID · Engine: CHITOS · Scanning logic runs on a private backend.
👉 Type a domain (e.g. example.com) in the box above and press Scan.
⚡ What it does
- Free instant scan reads one home page and summarizes security, SEO, and AI-visibility grades plus the most urgent issues.
- Non-intrusive and non-destructive reads only publicly exposed responses, with no attack, no load, and no login (read-only).
- Professional report with an overall grade, score bars, a full checklist (passing items included), and prioritized actions.
- English and Korean with browser-language auto-detection and an instant toggle (no re-scan needed).
🔎 What gets checked
1) Web security hygiene
Security response headers (CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, HSTS), forced HTTPS and HSTS preload, cookie flags (HttpOnly, Secure, SameSite), CORS policy, CSP quality, server and tech-stack exposure, TLS certificate validity, sensitive and backup file exposure (.env, .git, and more), security.txt, response compression, and cache policy.
2) Email security (deep)
SPF (policy and DNS lookups), DKIM signing, DMARC policy (monitor / quarantine / reject), BIMI, MTA-STS, and TLS-RPT. Diagnoses spoofing, phishing, and spam-folder risk.
3) DNS and domain (deep)
DNSSEC, CAA (certificate issuance control), MX, and NS redundancy.
4) Site-wide security consistency (deep)
HTTPS coverage across pages, per-page missing security headers, mixed content, external-script supply chain (missing SRI), and sensitive-pattern exposure.
5) SEO foundations
Title, meta description, canonical, structured data (Schema), OG tags, mobile viewport, indexability (noindex), content language, image alt-text, sitemap, and robots.txt.
6) AI visibility (GEO)
Reachability of 9 generative-AI and search crawlers (Googlebot, Bingbot, Naver Yeti, GPTBot, ClaudeBot, PerplexityBot, OAI-SearchBot, ChatGPT-User, Applebot). For ChatGPT, Claude, or Perplexity to read and cite your site, their crawlers must be able to get in first.
🧭 How to use it (a 3-step funnel)
- ① Free Instant Scan just enter a domain. Open to anyone, for any target.
- ② Domain-Verified Deep Scan sign in with a Hugging Face account registered on your company or organization domain email to confirm ownership, then unlock full-site pages, email and DNS checks, self-contradiction detection, and a downloadable report. Still non-intrusive.
- ③ In-Depth Consultation real vulnerabilities (SQL injection, file upload, auth bypass, IDOR) and AI-era deep diagnosis, performed under written authorization. Areas: Web Service · AX Infra · AI Model · AI Agent (AX-RAY).
- ④ Standards & Checklist a mapping to domestic and international security and AI-safety standards, plus a self-check list.
🚨 Why now — the rise of agentic attacks
AI agents now break in on their own. In 2026 the open-source AI penetration agent ARTEX was turned on real targets, hitting 2,250+ Microsoft 365 tenants, breaching e-commerce order databases, and automating recon-to-exfiltration against unpatched internet-facing systems worldwide. The common entry point was weak web and infrastructure hygiene. Attacks are automated now, so defense must be too. FreeWeb Security SCAN diagnoses web, infrastructure, AI models, and AI agents together.
📚 Standards we align with
International: OWASP Top 10, OWASP Top 10 for LLM Apps, OWASP ASVS, MITRE ATT&CK and ATLAS, NIST AI RMF, NIST SSDF, ISO/IEC 27001, ISO/IEC 42001, EU AI Act, Google SAIF. Regional: financial-sector AI-agent security criteria, national web and secure-coding guides, and information-security management frameworks.
Internal methodology, thresholds, and attack sets are confidential. This page shows only the mapping and the capability against public standards.
❓ FAQ
Is it really free? The first-step scan is free for anyone, with no login, card, or install.
Will it harm my site? No. It is non-intrusive and non-destructive (read-only). It performs no attacks, no load, and no form submissions, and reads only publicly exposed responses and headers.
What does it check? Security headers, HTTPS/HSTS, cookies, the TLS certificate, SPF/DKIM/DMARC/BIMI/MTA-STS, DNSSEC/CAA, mixed content and SRI, reachability of 9 AI crawlers, and SEO fundamentals.
What is AI visibility (GEO)? Whether generative-AI assistants and search crawlers can read your site and cite it in their answers. A common issue is a robots.txt that allows everyone while a firewall quietly blocks AI bots.
How do I run a deep scan? Sign in with a Hugging Face account registered on the target domain's email. Ownership is confirmed and the full-site report opens. Unauthorized deep scans of other sites are not allowed.
Do you test for real vulnerabilities (intrusion)? Active testing is provided only within the owner's written authorization, via the in-depth consultation step.
What should I do with the results? Fix High items first, then Advisory, then Low. For real vulnerabilities and AI-agent threats, continue to the in-depth consultation.
🔐 Privacy and safety
- Every check is non-intrusive and non-destructive (read-only) and does not affect the target.
- Deep-scan ownership is judged only by your account's verified email domain.
- Results reflect the time of measurement, and the internal methodology is not disclosed.
Non-intrusive and non-destructive · no unauthorized deep scans of other sites · active testing only after domain verification and authorization · Service: QuantID · Engine: CHITOS.