Step 1 — Create an account
Go to /register and fill in your details. After registration you'll receive a verification email. Click the link in the email to activate your account.
Step 2 — Log in and open the scanner
After logging in you'll land on the scanner dashboard. If you see the landing page, click Sign In in the top navigation.
Step 3 — Enter a target URL
In the Target URL field, enter the full URL of the site you want to scan, including the scheme:
https://example.com
Step 4 — Choose a scan type
Select one of four scan types from the dropdown:
- Vulnerability — OWASP Top 10 checks only (fastest)
- Performance — DNS, TTFB, HTTP/2, compression, caching
- Full — both vulnerability and performance (recommended)
- API — REST API-specific checks: BOLA, mass assignment, rate limiting, GraphQL introspection, excessive data exposure
Step 5 — Start the scan
Click Start Scan. The progress panel will appear immediately with live updates as each check completes. Typical scan duration is 30–90 seconds depending on the site and scan type.
Step 6 — Review results
When the scan completes, results are grouped by severity:
| Severity | Meaning |
|---|---|
| CRITICAL | Immediate risk. Direct exploitation likely. |
| HIGH | Significant risk. Should be fixed promptly. |
| MEDIUM | Moderate risk. Fix when possible. |
| LOW | Minor risk or best-practice violation. |
| INFO | Informational. No immediate risk. |
Step 7 — Download a report
Click Download PDF to get a professional report with all findings, evidence, OWASP mapping, and remediation steps. You can also export as JSON, CSV, or SARIF from the same panel.