--- title: "FreeWeb Security SCAN — Free Web Security & AI-Visibility Check" emoji: 🛡 colorFrom: purple colorTo: indigo sdk: gradio sdk_version: 5.49.1 app_file: app.py pinned: false license: other hf_oauth: true hf_oauth_scopes: - email short_description: "Free web security, SEO & AI-visibility (GEO) scan" tags: - security - cybersecurity - web-security - vulnerability-scanner - security-headers - spf-dmarc - dns - dnssec - tls - seo - geo - aeo - ai-visibility - llm-crawler - owasp - nist - non-intrusive - gradio --- # 🛡 FreeWeb Security SCAN — Free Web Security & AI-Visibility Check **Enter a domain and in about 10 to 25 seconds** get a **free, non-intrusive (read-only)** assessment of your website's **security, SEO, and AI visibility (GEO)**. No login, no install, no credit card. > Service: **QuantID** · Engine: **CHITOS** · Scanning logic runs on a private backend. 👉 **Type a domain (e.g. `example.com`) in the box above and press Scan.** --- ## ⚡ What it does - **Free instant scan** reads one home page and summarizes security, SEO, and AI-visibility grades plus the most urgent issues. - **Non-intrusive and non-destructive** reads only publicly exposed responses, with no attack, no load, and no login (read-only). - **Professional report** with an overall grade, score bars, a full checklist (passing items included), and prioritized actions. - **English and Korean** with browser-language auto-detection and an instant toggle (no re-scan needed). --- ## 🔎 What gets checked ### 1) Web security hygiene Security response headers (CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, HSTS), forced HTTPS and HSTS preload, cookie flags (HttpOnly, Secure, SameSite), CORS policy, CSP quality, server and tech-stack exposure, **TLS certificate validity**, sensitive and backup file exposure (`.env`, `.git`, and more), `security.txt`, response compression, and cache policy. ### 2) Email security (deep) **SPF** (policy and DNS lookups), **DKIM** signing, **DMARC** policy (monitor / quarantine / reject), **BIMI**, **MTA-STS**, and **TLS-RPT**. Diagnoses spoofing, phishing, and spam-folder risk. ### 3) DNS and domain (deep) **DNSSEC**, **CAA** (certificate issuance control), **MX**, and **NS redundancy**. ### 4) Site-wide security consistency (deep) HTTPS coverage across pages, per-page missing security headers, **mixed content**, **external-script supply chain (missing SRI)**, and sensitive-pattern exposure. ### 5) SEO foundations Title, meta description, canonical, structured data (Schema), OG tags, mobile viewport, indexability (noindex), content language, image alt-text, sitemap, and robots.txt. ### 6) AI visibility (GEO) Reachability of **9 generative-AI and search crawlers** (Googlebot, Bingbot, Naver Yeti, GPTBot, ClaudeBot, PerplexityBot, OAI-SearchBot, ChatGPT-User, Applebot). For ChatGPT, Claude, or Perplexity to read and **cite** your site, their crawlers must be able to get in first. --- ## 🧭 How to use it (a 3-step funnel) 1. **① Free Instant Scan** just enter a domain. Open to anyone, for any target. 2. **② Domain-Verified Deep Scan** sign in with a **Hugging Face account registered on your company or organization domain email** to confirm ownership, then unlock full-site pages, email and DNS checks, self-contradiction detection, and a downloadable report. Still non-intrusive. 3. **③ In-Depth Consultation** real vulnerabilities (SQL injection, file upload, auth bypass, IDOR) and AI-era deep diagnosis, performed under **written authorization**. Areas: **Web Service · AX Infra · AI Model · AI Agent (AX-RAY)**. 4. **④ Standards & Checklist** a mapping to domestic and international security and AI-safety standards, plus a self-check list. --- ## 🚨 Why now — the rise of agentic attacks AI agents now break in on their own. In 2026 the open-source AI penetration agent **ARTEX** was turned on real targets, hitting **2,250+ Microsoft 365 tenants**, breaching e-commerce order databases, and automating recon-to-exfiltration against **unpatched internet-facing systems worldwide**. The common entry point was weak web and infrastructure hygiene. Attacks are automated now, so defense must be too. FreeWeb Security SCAN diagnoses **web, infrastructure, AI models, and AI agents** together. --- ## 📚 Standards we align with **International**: OWASP Top 10, OWASP Top 10 for LLM Apps, OWASP ASVS, MITRE ATT&CK and ATLAS, NIST AI RMF, NIST SSDF, ISO/IEC 27001, ISO/IEC 42001, EU AI Act, Google SAIF. **Regional**: financial-sector AI-agent security criteria, national web and secure-coding guides, and information-security management frameworks. > Internal methodology, thresholds, and attack sets are confidential. This page shows only the mapping and the capability against public standards. --- ## ❓ FAQ **Is it really free?** The first-step scan is free for anyone, with no login, card, or install. **Will it harm my site?** No. It is non-intrusive and non-destructive (read-only). It performs no attacks, no load, and no form submissions, and reads only publicly exposed responses and headers. **What does it check?** Security headers, HTTPS/HSTS, cookies, the TLS certificate, SPF/DKIM/DMARC/BIMI/MTA-STS, DNSSEC/CAA, mixed content and SRI, reachability of 9 AI crawlers, and SEO fundamentals. **What is AI visibility (GEO)?** Whether generative-AI assistants and search crawlers can read your site and cite it in their answers. A common issue is a robots.txt that allows everyone while a firewall quietly blocks AI bots. **How do I run a deep scan?** Sign in with a Hugging Face account registered on the target domain's email. Ownership is confirmed and the full-site report opens. Unauthorized deep scans of other sites are not allowed. **Do you test for real vulnerabilities (intrusion)?** Active testing is provided only within the owner's written authorization, via the in-depth consultation step. **What should I do with the results?** Fix High items first, then Advisory, then Low. For real vulnerabilities and AI-agent threats, continue to the in-depth consultation. --- ## 🔐 Privacy and safety - Every check is **non-intrusive and non-destructive (read-only)** and does not affect the target. - Deep-scan ownership is judged only by your account's **verified email domain**. - Results reflect the time of measurement, and the internal methodology is not disclosed. --- *Non-intrusive and non-destructive · no unauthorized deep scans of other sites · active testing only after domain verification and authorization · Service: QuantID · Engine: CHITOS.*