GoScreenAPI
Security Audit Scanner
v2 — Now with SSL, Headers & Tech Detection

Find Exposed Files
Before Attackers Do.

Automatically scan any website for exposed .env files, database dumps, backup archives, and configuration leaks — plus SSL certificate analysis, HTTP security headers audit, and technology stack detection.

Start Free Security Scan → Sign In
HEAD-only — no file downloads SSL/TLS certificate analysis HTTP security headers audit Technology stack detection Visual evidence screenshots Differential scanning Tamper-proof certificates SSRF protected

How It Works

Four steps from URL to a complete security report.

STEP 01

Enter Target URL

Provide the domain you want to audit. We detect the technology stack automatically.

STEP 02

SSL & Header Analysis

We check your SSL certificate validity, expiry, and 6 critical HTTP security headers.

STEP 03

Async HEAD Scanning

Our scanner sends HEAD-only requests to 90+ known sensitive paths filtered by your tech stack.

STEP 04

Visual Evidence & Diff

HTTP 200 findings get a screenshot + certificate. Differential engine shows what changed since last scan.

NEW IN v2

Beyond File Scanning

v2 adds four new analysis layers on top of the core probe scanner.

Technology Detection

Automatically detects WordPress, Laravel, Django, Node.js, ASP.NET, and more. Scan paths are filtered to match your stack — fewer false positives, more relevant findings.

WordPress Laravel Django Node.js ASP.NET PHP

SSL/TLS Certificate Audit

Checks certificate validity, expiry date, issuer, chain integrity, and supported TLS protocol versions. Alerts when certificates expire within 30 days.

Expiry date Chain validity TLS 1.2/1.3 Issuer info

HTTP Security Headers

Audits 6 critical security headers that protect against XSS, clickjacking, MIME sniffing, and data leakage. Shows exactly which headers are missing.

CSP HSTS X-Frame-Options X-Content-Type Referrer-Policy Permissions-Policy

Differential Scanning

Compares each scan against the previous one. Instantly see new exposures, resolved issues, and persisting vulnerabilities — so you know exactly what changed.

New findings Resolved issues Persisting First scan detection

What We Scan For

90+ known sensitive paths across three categories, filtered by detected technology stack.

Sensitive Data

Critical severity

.env .git/config phpinfo.php docker-compose.yml .DS_Store web.config .env.backup .env.production .env.local .git/HEAD .gitignore info.php test.php docker-compose.yaml Dockerfile .ssh/id_rsa id_rsa server-status server-info crossdomain.xml clientaccesspolicy.xml robots.txt sitemap.xml .well-known/security.txt package.json composer.json composer.lock

Backup Files

Critical / High severity

backup.zip backup.tar.gz db.sql database.sql dump.sql site.tar.gz www.rar index.php.bak wp-content/uploads/backup.zip backup.sql data.sql mysql.sql site.zip www.zip www.tar.gz public_html.zip htdocs.zip index.html.bak old.zip archive.zip files.zip upload.zip logs.zip error.log access.log debug.log storage/logs/laravel.log var/log/apache2/error.log

Config Files

Critical / High severity

wp-config.php.save wp-config.php.bak config.php.old .htaccess.bak config.yml settings.py appsettings.json wp-config.php.old wp-config.php~ config.php config.php.bak configuration.php configuration.php.bak .htaccess .htpasswd config.yaml config.json local_settings.py appsettings.Development.json application.properties application.yml database.yml secrets.yml credentials.json serviceAccountKey.json .npmrc .pypirc Gemfile Gemfile.lock yarn.lock .travis.yml .circleci/config.yml Jenkinsfile terraform.tfvars .terraform/terraform.tfstate
VISUAL EVIDENCE

Screenshot Proof for Every Finding

When a sensitive file is found accessible (HTTP 200), our Playwright worker automatically captures a full-page screenshot as visual evidence — timestamped and stored securely.

  • Full-page screenshot captured automatically
  • SHA-256 hash for tamper detection
  • Downloadable PDF verification certificate
  • Publicly verifiable at /verify/{id}
https://example.com/.env
APP_NAME=MyApp
APP_ENV=production
DB_PASSWORD=s3cr3t_p4ss
AWS_SECRET_ACCESS_KEY=AKIAIOSFODNN7EXAMPLE
STRIPE_KEY=sk_live_...
⚠ CRITICAL — .env exposed CERT-20260101-A1B2C3D4
LIVE EVIDENCE

Ready to Audit Your Site?

Start a free security scan in seconds. No credit card required.

Create Free Account →
Part of GoScreenAPI Intelligence Platform

Comprehensive Security Features

Initiating a website security audit enhances your site's defense capabilities. Our platform conducts a thorough security scan to ensure each potential vulnerability is addressed. Specifically, this includes SSL certificate validation, which checks for integrity and encryption standards that meet industry-level protocols.

Response times remain impressive: complete scans finalize within an average of 1.3 seconds per page. Reports can be generated in PDF format, with file sizes ranging between 300KB and 500KB, making them easy to share and analyze.

HTTP Security Headers

Implementing HTTP security headers is critical for safeguarding web applications. Our audit includes a detailed check of HTTP headers such as HSTS, CSP, and X-Frame-Options. These headers prevent man-in-the-middle attacks and clickjacking, minimizing potential security breaches.

The process involves analyzing each header for compliance and effectiveness. As a result, your site's security score improves significantly. In practice, implementing these enhances data integrity and user trust.

Advanced Tech Stack Detection

Analyzing the underlying technology stack reveals crucial insights. Our website security audit detects frameworks and libraries, identifying outdated components. This is achieved in less than 2 seconds per component check.

We use a combination of real-time data and historical patterns to flag potential weaknesses. Our vulnerability scanner matches known issues with specific software versions. This proactive approach minimizes security risks.

Open Port and Vulnerability Scans

Open ports present significant security risks. Our audit includes a security scan that inspects these ports for unauthorized access points. It efficiently covers a full port range in under 30 seconds.

To complement this, we use an SSL checker to validate encryption protocols. This process is crucial for identifying misconfigurations that could expose sensitive data.

  • Ensure all SSL certificates comply with industry standards.
  • Verify HTTP headers for complete security posture.
  • Identify outdated libraries with the tech stack detection.
  • Scan open ports for unauthorized access points.
  • Match known vulnerabilities to mitigate risks effectively.

Dashboard and Reporting

The audit platform includes a robust dashboard for managing recurring scans. It schedules automatic checks and notifies administrators of potential threats. Users can customize frequency and scope for comprehensive coverage.

Reports generated are available in PDF format, ensuring they are accessible and easily shared with your security team. Each report provides actionable insights to enhance your site security test.

Conduct a website security audit today and safeguard your digital assets effortlessly.

Frequently Asked Questions

What is a website security audit?

A website security audit is a comprehensive evaluation of a website's security posture. It involves identifying vulnerabilities, analyzing security policies, and assessing compliance with best practices to protect against threats and breaches.

How can I check if my SSL certificate is valid?

To check the validity of your SSL certificate, use tools like SSL Labs or our built-in SSL checker. These tools provide detailed reports on the certificate's expiration date, issuance authority, and configuration grade.

What are security headers and why are they important?

Security headers are HTTP response headers that enhance website security by preventing attacks such as XSS and clickjacking. Key headers include Content Security Policy (CSP), X-Content-Type-Options, and X-Frame-Options, which help control browser behavior.

What is vulnerability scanning and how does it work?

Vulnerability scanning involves automated tools that scan web applications for known vulnerabilities, such as SQL injection and cross-site scripting. Scans typically take a few minutes and generate reports detailing identified issues and suggested remediation steps.