Free check
For any public website. All read-only checks, every finding with a fix, open ports listed in a public internet database, and a report link you can share.
Check a siteExternal website security check
A security snapshot of your website, taken from outside
We check what anyone online can see: subdomains, TLS, mail records, security headers, exposed files and software versions. Then we show what to fix first.
Only check sites you own or are allowed to test. How our scanner works
- Free, no sign-up
- Read-only checks, no exploits
- Live progress
Sample report
Findings by area
Findings listed in the report22
- High 1
- Medium 7
- Low 14
| Outdated software | 2 |
|---|---|
| TLS and HTTPS | 3 |
| Cookies and browser security controls | 4 |
| Exposure checks | 3 |
| Email security | 5 |
| Domain and DNS | 2 |
| Inventory notes, no action needed | 3 |
What ZNIMOK checks
Dozens of checks for every host we find, in six areas.
-
Domain and subdomains
Subdomains from DNS, mail records and certificate logs, dangling CNAMEs and the domain expiry date.
-
TLS and HTTPS
Certificate validity and hostname, outdated TLS versions, the redirect to HTTPS and HSTS.
-
Email security
SPF, DKIM, DMARC, MTA-STS and TLS-RPT: can someone send mail in your name?
Email security check -
Browser security controls
Security headers, Content-Security-Policy, cookie flags, CORS, clickjacking protection and security.txt.
Security headers check -
Exposed files and panels
Publicly reachable .env and .git files, backups, admin and database panels, API docs and source maps.
How we look for them -
Software and known vulnerabilities
Detected technologies and versions checked against NVD, OSV and CISA KEV. A match signals a possible risk, not a confirmed breach.
Outdated software check
Running WordPress? WordPress security check. Also in the report: Google PageSpeed, legal documents (privacy, cookies, Impressum), AI crawler access and public domain records. Full methodology: what we check and what we do not
How it works
Enter your site
A domain or full URL. No account needed.
Watch it run
Each module updates live as evidence comes in. Most checks finish in a few minutes.
Fix what matters
A score out of 100, key points first, and for every finding: what we saw, why it matters and what to do. Share the report by link.
Free check and verified owner
Read-only checks for any site. Active checks only for sites you prove are yours.
Verified owner
For sites you control. Confirm ownership with a DNS TXT record, a file or a meta tag, and ZNIMOK can also run active checks: a TCP and UDP port check and a deep API audit. Only verified owners see their results.
Create a free accountWhere the data comes from
Findings come from fixed rules and public databases. No AI model analyzes your site.
- NVDCVE records for detected software versions.
- OSVknown vulnerabilities in open source packages.
- CISA KEVvulnerabilities known to be exploited in attacks.
- FIRST EPSShow likely a known vulnerability is to be exploited.
- endoflife.datewhich release lines still get security fixes.
- Certificate Transparency, RDAPhostnames and domain registration data.
Questions
Does ZNIMOK use AI to analyze my site?
No. Findings come from rule-based checks and public vulnerability databases: NVD, OSV, CISA KEV and FIRST EPSS. The AI readiness section of the report shows something else: whether AI crawlers such as GPTBot or ClaudeBot can read your site.
Does a finding mean my site was hacked?
No. A finding is a weakness visible from outside. A software version that matches a known vulnerability is a possible risk until someone confirms it. The report also shows what we could not check.
Is it legal to check a website with ZNIMOK?
For a site without verified ownership, the check only reads what is publicly reachable and sends ordinary read-only requests. Still, please check only sites you own or are authorized to assess. Active checks run only on sites with verified ownership, and only the verified owner sees their results. This is not legal advice.
What does ZNIMOK not check?
We do not scan for malware or check blocklists. The free check does not log in, guess passwords or run SQL injection or XSS attacks: it reads public responses, looks for common sensitive files and admin panels, and sends a few safe probes. Active probes run only on sites with verified ownership, and only the verified owner sees their results.
How long does a check take?
Usually a few minutes. Sites with many subdomains take longer. You can watch progress live.
How much does it cost?
The public check is free and needs no sign-up. A free account is enough to verify ownership of your sites.
Get your site's security snapshot
Free, no sign-up, results in a few minutes.
Only check sites you own or are allowed to test. How our scanner works