Discover. Assess. Secure.
WebGuard AI runs an authorized vulnerability assessment of your website from a single URL — real passive and safe active checks, live progress, and a report that never fakes a pass.
- Real scanner execution with persisted, evidence-based results
- SSRF & private-network protection on every request
- Clear PASS / FAIL / BLOCKED / NOT TESTED status with reasons
Start your free assessment
One complimentary scan per domain.
Broad, honest assessment coverage
A database-driven registry of 71 automated controls across 15 domains — every one produces a real, evidence-based result. We don’t pad coverage with checks that can’t run from a URL.
Security headers & TLS
CSP, HSTS, cookies, certificate, protocol & cipher posture
DNS & email security
SPF, DMARC, DNSSEC, MX and spoofing protection
Information disclosure
.env, .git, phpinfo, source maps, directory listing, banners
OWASP-aligned web checks
CORS, methods, open redirect, clickjacking, GraphQL exposure
Technology & EOL risk
Fingerprinting, PHP end-of-life, PHP2Shell CVE correlation
CMS & frameworks
WordPress, Next.js/React signals, frontend secret exposure
From URL to report in three steps
Authorize
Confirm ownership or written permission. We validate the URL and block private, internal, and metadata addresses.
Assess in real time
Isolated workers run passive and safe active checks with rate limits and live progress streamed to your browser.
Receive your report
Get an evidence-based PDF/JSON report with severity, remediation, and an honest coverage statement.
Free to start. Enterprise when you scale.
Every domain gets one complimentary assessment with a downloadable report. For continuous monitoring, authenticated scans, and full inline dashboards, talk to our team.
- Full passive + safe active scan
- Live progress in your browser
- Downloadable PDF / JSON / CSV report
- Evidence-based, honest coverage
Privacy & responsible testing
We validate and re-validate DNS to prevent SSRF and DNS-rebinding, block private/internal/metadata addresses, apply rate limits and request budgets, and redact sensitive evidence. We never run destructive tests or exploit payloads, and we do not share your data with third parties.