| --- |
| title: "FreeWeb Security SCAN — Free Web Security & AI-Visibility Check" |
| emoji: 🛡 |
| colorFrom: purple |
| colorTo: indigo |
| sdk: gradio |
| sdk_version: 5.49.1 |
| app_file: app.py |
| pinned: false |
| license: other |
| hf_oauth: true |
| hf_oauth_scopes: |
| - email |
| short_description: "Free web security, SEO & AI-visibility (GEO) scan" |
| tags: |
| - security |
| - cybersecurity |
| - web-security |
| - vulnerability-scanner |
| - security-headers |
| - spf-dmarc |
| - dns |
| - dnssec |
| - tls |
| - seo |
| - geo |
| - aeo |
| - ai-visibility |
| - llm-crawler |
| - owasp |
| - nist |
| - non-intrusive |
| - gradio |
| --- |
| |
| # 🛡 FreeWeb Security SCAN — Free Web Security & AI-Visibility Check |
|
|
| **Enter a domain and in about 10 to 25 seconds** get a **free, non-intrusive (read-only)** assessment of your website's **security, SEO, and AI visibility (GEO)**. No login, no install, no credit card. |
|
|
| > Service: **QuantID** · Engine: **CHITOS** · Scanning logic runs on a private backend. |
|
|
| 👉 **Type a domain (e.g. `example.com`) in the box above and press Scan.** |
|
|
| --- |
|
|
| ## ⚡ What it does |
|
|
| - **Free instant scan** reads one home page and summarizes security, SEO, and AI-visibility grades plus the most urgent issues. |
| - **Non-intrusive and non-destructive** reads only publicly exposed responses, with no attack, no load, and no login (read-only). |
| - **Professional report** with an overall grade, score bars, a full checklist (passing items included), and prioritized actions. |
| - **English and Korean** with browser-language auto-detection and an instant toggle (no re-scan needed). |
|
|
| --- |
|
|
| ## 🔎 What gets checked |
|
|
| ### 1) Web security hygiene |
| Security response headers (CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, HSTS), forced HTTPS and HSTS preload, cookie flags (HttpOnly, Secure, SameSite), CORS policy, CSP quality, server and tech-stack exposure, **TLS certificate validity**, sensitive and backup file exposure (`.env`, `.git`, and more), `security.txt`, response compression, and cache policy. |
|
|
| ### 2) Email security (deep) |
| **SPF** (policy and DNS lookups), **DKIM** signing, **DMARC** policy (monitor / quarantine / reject), **BIMI**, **MTA-STS**, and **TLS-RPT**. Diagnoses spoofing, phishing, and spam-folder risk. |
|
|
| ### 3) DNS and domain (deep) |
| **DNSSEC**, **CAA** (certificate issuance control), **MX**, and **NS redundancy**. |
|
|
| ### 4) Site-wide security consistency (deep) |
| HTTPS coverage across pages, per-page missing security headers, **mixed content**, **external-script supply chain (missing SRI)**, and sensitive-pattern exposure. |
|
|
| ### 5) SEO foundations |
| Title, meta description, canonical, structured data (Schema), OG tags, mobile viewport, indexability (noindex), content language, image alt-text, sitemap, and robots.txt. |
|
|
| ### 6) AI visibility (GEO) |
| Reachability of **9 generative-AI and search crawlers** (Googlebot, Bingbot, Naver Yeti, GPTBot, ClaudeBot, PerplexityBot, OAI-SearchBot, ChatGPT-User, Applebot). For ChatGPT, Claude, or Perplexity to read and **cite** your site, their crawlers must be able to get in first. |
|
|
| --- |
|
|
| ## 🧭 How to use it (a 3-step funnel) |
|
|
| 1. **① Free Instant Scan** just enter a domain. Open to anyone, for any target. |
| 2. **② Domain-Verified Deep Scan** sign in with a **Hugging Face account registered on your company or organization domain email** to confirm ownership, then unlock full-site pages, email and DNS checks, self-contradiction detection, and a downloadable report. Still non-intrusive. |
| 3. **③ In-Depth Consultation** real vulnerabilities (SQL injection, file upload, auth bypass, IDOR) and AI-era deep diagnosis, performed under **written authorization**. Areas: **Web Service · AX Infra · AI Model · AI Agent (AX-RAY)**. |
| 4. **④ Standards & Checklist** a mapping to domestic and international security and AI-safety standards, plus a self-check list. |
|
|
| --- |
|
|
| ## 🚨 Why now — the rise of agentic attacks |
|
|
| AI agents now break in on their own. In 2026 the open-source AI penetration agent **ARTEX** was turned on real targets, hitting **2,250+ Microsoft 365 tenants**, breaching e-commerce order databases, and automating recon-to-exfiltration against **unpatched internet-facing systems worldwide**. The common entry point was weak web and infrastructure hygiene. Attacks are automated now, so defense must be too. FreeWeb Security SCAN diagnoses **web, infrastructure, AI models, and AI agents** together. |
|
|
| --- |
|
|
| ## 📚 Standards we align with |
|
|
| **International**: OWASP Top 10, OWASP Top 10 for LLM Apps, OWASP ASVS, MITRE ATT&CK and ATLAS, NIST AI RMF, NIST SSDF, ISO/IEC 27001, ISO/IEC 42001, EU AI Act, Google SAIF. |
| **Regional**: financial-sector AI-agent security criteria, national web and secure-coding guides, and information-security management frameworks. |
|
|
| > Internal methodology, thresholds, and attack sets are confidential. This page shows only the mapping and the capability against public standards. |
|
|
| --- |
|
|
| ## ❓ FAQ |
|
|
| **Is it really free?** |
| The first-step scan is free for anyone, with no login, card, or install. |
|
|
| **Will it harm my site?** |
| No. It is non-intrusive and non-destructive (read-only). It performs no attacks, no load, and no form submissions, and reads only publicly exposed responses and headers. |
|
|
| **What does it check?** |
| Security headers, HTTPS/HSTS, cookies, the TLS certificate, SPF/DKIM/DMARC/BIMI/MTA-STS, DNSSEC/CAA, mixed content and SRI, reachability of 9 AI crawlers, and SEO fundamentals. |
|
|
| **What is AI visibility (GEO)?** |
| Whether generative-AI assistants and search crawlers can read your site and cite it in their answers. A common issue is a robots.txt that allows everyone while a firewall quietly blocks AI bots. |
|
|
| **How do I run a deep scan?** |
| Sign in with a Hugging Face account registered on the target domain's email. Ownership is confirmed and the full-site report opens. Unauthorized deep scans of other sites are not allowed. |
|
|
| **Do you test for real vulnerabilities (intrusion)?** |
| Active testing is provided only within the owner's written authorization, via the in-depth consultation step. |
|
|
| **What should I do with the results?** |
| Fix High items first, then Advisory, then Low. For real vulnerabilities and AI-agent threats, continue to the in-depth consultation. |
|
|
| --- |
|
|
| ## 🔐 Privacy and safety |
|
|
| - Every check is **non-intrusive and non-destructive (read-only)** and does not affect the target. |
| - Deep-scan ownership is judged only by your account's **verified email domain**. |
| - Results reflect the time of measurement, and the internal methodology is not disclosed. |
|
|
| --- |
|
|
| *Non-intrusive and non-destructive · no unauthorized deep scans of other sites · active testing only after domain verification and authorization · Service: QuantID · Engine: CHITOS.* |
|
|
