Short answer: No single free tool finds everything, but five cover most of the ground: MDN HTTP Observatory for security headers, Qualys SSL Labs for the secure connection, OWASP ZAP's baseline scan for common web flaws, npm audit or GitHub Dependabot for known holes in your libraries, and gitleaks for keys committed to your code. The vibeship quick check runs sixteen outside checks in one go, including keys shipped to the browser and open Supabase or Firebase data. Only scan sites you own or have permission to test.
| Tool | What it checks | Good to know |
|---|---|---|
| MDN HTTP Observatory | Security headers, cookies, redirects; grade A+ to F | No account. Does not check the certificate setup any more |
| securityheaders.com | Security headers; grade A+ to F | One page, one request. Run by Snyk |
| Qualys SSL Labs | Certificate, protocol versions, ciphers | The reference for the padlock; takes a minute or two |
| Google PageSpeed Insights | Speed plus a short best-practices list | Not a security tool, but flags some issues |
| OWASP ZAP baseline | Passive scan of many pages for common flaws | Free and open source. You install and run it; the active scan sends real attacks |
| npm audit / Dependabot | Known holes in your libraries | Needs your code, not your site |
| gitleaks | Keys and passwords committed to git history | Needs your code |
| Supabase Security Advisor | Tables without row level security, risky functions | In your Supabase dashboard |
| vibeship quick check | Sixteen outside checks: keys in the browser, open databases, private files, headers, PHP2Shell, email forgery, legal pages, speed | No account. Free shows the grade and counts per area; the details are paid |
What each free tool is good at, and what none of them can see.
Run the header and connection checks (Observatory, SSL Labs) or the vibeship quick check. These are passive: they read what any visitor receives.
Search your site's scripts for secret keys, and test your database rules as a stranger. Header graders miss this completely, and it is the most common serious problem on AI-built apps. How.
Run npm audit (or pip-audit, composer audit), turn on Dependabot alerts, and run gitleaks detect once over the whole history.
ZAP's full scan sends real attack payloads. Point it at your own site, ideally a copy, never at someone else's: in many countries an unauthorised attack is a crime even if nothing breaks.
No free outside scanner can tell whether customer A can open customer B's data. Two test accounts and ten minutes can.
You can do all of the above by hand. If you'd rather start with a list of what's wrong, the vibeship quick check runs from outside, the way a stranger sees your site. The quick check is free and needs no account. It shows your grade and how many problems sit in each area; what each problem is and how to fix it is in the full report.
Reading what a site sends to every visitor (headers, pages, scripts) is what browsers do. Sending attack payloads to a site you don't own or have written permission for is not, in most countries. Passive checks on anyone's site, active scans only on your own.
No. Outside scans can't see business logic, access between users, or most of what sits behind a login. They find the common, cheap-to-exploit problems, which are most of what automated attackers use.
One that checks your browser code for keys and your database rules, because those leak data directly. Header grades matter, but a missing header is rarely how a small app gets breached.
After every release that changes sign-in, payments or database access, and at least monthly otherwise.
Sources checked on 25 October 2026.