Free scan

Free website security scan

Paste your site's address and xlogs checks the live site the way an outsider would, then tells you in plain English what it found and how to fix it. No account, no signup, and every finding is free. It is read-only: it only makes the same requests a normal visitor's browser already makes.

Scan your website

Free and read-only. No signup.

By using xlogs, you agree to our Terms, Privacy Policy, and Disclaimer.

What the scan checks

xlogs focuses on the issues that actually get exploited on modern sites, especially ones built quickly with AI tools:

  • A database anyone can read. If your app uses Supabase, xlogs asks your database, as a logged-out stranger, whether it hands back rows it should not.
  • Secret keys in the browser. It scans the JavaScript your site ships for API and service keys that were never meant to leave your server.
  • Missing security headers. The standard headers browsers use to block common attacks, and which ones your site is missing.
  • Downloadable source code. Whether your production site serves source maps that rebuild your original code.
  • Public files that should be private. Files like .env and .git reachable by anyone.
  • Dangling DNS and email spoofing gaps. A subdomain pointing at a service that is gone, or a domain with no SPF and DMARC.

Each finding comes with the evidence behind it and a confidence label, so you can tell a confirmed exposure from a missing precaution.

How it works

  1. You paste your site's URL. No account, nothing to install.
  2. xlogs runs its read-only checks and shows each finding with plain-English context.
  3. Each issue comes with a copy-paste fix written for your coding tool, like Lovable, Cursor, or Claude Code.
  4. You fix it, then re-scan to independently confirm the issue is gone. Re-scans are unlimited and free.

What a scan does not do

Being honest about the limits is the point. xlogs scans the live site from the outside. It does not read your source repository, so source-only issues like SQL injection and unsafe HTML rendering are out of scope here, and it is not a dependency or CVE scanner. A clean scan means these specific checks found nothing, not that the site is guaranteed secure. See the methodology for the exact list of requests it sends.