Compare scanners
Every scanner seesfrom one chair
Comparison pages list five tools, their prices and their feature checkmarks, and go stale before the next quarter. What does not go stale is the question underneath: what can each kind of tool actually observe, and what is invisible from where it sits?
- Six kinds of tool
- No prices quoted
- Our numbers from the registry
- Where it abstains, said
The map
Six kinds of tool,
six different views
Each card says what that kind of tool can see, what it structurally cannot, and what this product does with the same question. The cannots are not flaws — they are the consequence of the chair a tool stands on.
Header and TLS graders
Can see
The configuration a server publishes before it publishes anything else: the policy headers on the response, the certificate chain, the protocol versions and cipher suites it will negotiate.
Cannot see
Everything that requires asking for a second page. A perfect A+ on a grader that reads one endpoint says nothing about whether the same key that signs in you also lists every row in the database.
securityheaders.com, SSL Labs.
Here: Inside the scan: CSP, HSTS, X-Frame-Options, referrer and permissions policy, certificate expiry, protocol version, HTTPS redirect — plus the DNS, mail and domain records no header grader looks at.
Infrastructure vulnerability scanners
Can see
Hosts, ports and services, matched against a library of known vulnerabilities. The most thorough answer available to someone who has permission to run it.
Cannot see
Permission is the whole story: these tools need to be installed, pointed at ranges you own, and usually rate-limited or somebody’s load balancer files a abuse complaint. They also read infrastructure, not your page — a site with a perfect network stack and an open .env is still open.
Nuclei, network vulnerability scanners.
Here: Not this product. What we run instead is a fixed set of read-only checks against one URL, on shared infrastructure, which is why the answer arrives in seconds and why private and metadata addresses are refused before a request leaves.
Active application scanners (DAST)
Can see
What your application does when it is provoked: authenticated crawling, payloads submitted to parameters, business-logic paths walked with a session attached.
Cannot see
It cannot be a stranger to your site, because it has to be introduced to it. That means credentials, a scope you configure, an outage risk while it crawls, and a scan that is slow enough to run on a schedule rather than on a whim.
OWASP ZAP, Burp Suite, commercial DAST platforms.
Here: Deliberately the opposite chair. A scan here never logs in, never submits a form of yours, never calls a state-changing endpoint — so it can run on a URL you pasted thirty seconds ago. Injection, XSS, open redirects and JWT handling are read from what the page exposes and the limited probes its own inputs allow.
SEO and performance auditors
Can see
The document and its assets: tags, headings, structured data, links, and how long the page takes to become usable in a real browser.
Cannot see
The transport. A crawler audit does not care that your session cookie is missing SameSite, or that the same key which renders your product page also reads your customers’ table.
Lighthouse, PageSpeed Insights, site audit crawlers.
Here: The same fetch answers those questions too — 17 SEO checks and 8 for AI answer engines, in the one report, next to the security findings rather than in a second dashboard.
Blocklist and reputation checkers
Can see
Whether your domain has already been reported: malware and phishing listings, safe-browsing status, blacklist presence.
Cannot see
Anything before the event. A listing tells you the damage was found by somebody else; it cannot tell you why the page was serving it.
Google Safe Browsing, VirusTotal.
Here: Not covered, and said so rather than implied. The closest thing here is detection of the conditions that get you listed — exposed paths, source maps, mixed content, a stack running versions with known exploits.
Repository scanners
Can see
Your source: hardcoded secrets, dependency versions with known vulnerabilities, licence conflicts, an inventory of what ships.
Cannot see
Behaviour. A repository is a statement of intent; the deployed site is the same intent plus every environment variable, proxy rule and CDN setting nobody committed.
Semgrep, Trivy, Gitleaks, SCA platforms.
Here: This product has one: install the GitHub App and a repository gets secrets, dependency vulnerabilities ranked against known-exploited listings, licence policy and an SBOM. The site scan and the repo scan are two reads of the same asset, and neither sees the other’s half.
A tool that abstains is not a tool that failed. It is a tool telling you where its eyes are.
This product’s seat
One read-only pass,
six pillars wide
A header grader’s reach, an SEO auditor’s breadth, and none of an active scanner’s permissions. That is the position, stated before any feature list.
- 85
- checks per scan, from the registry
- 6
- pillars in one report
- 1
- URL pasted, one fetch, seconds
- 0
- logins, form submissions or state changes
It will not touch your state
No authentication, no submitted forms, no request that could change anything. That is not a limitation to apologise for — it is the reason a scan can run against a live site at three in the afternoon without a change ticket.
It will not go where it is not welcome
Private, loopback, link-local and metadata addresses are refused before the socket opens, and robots.txt is obeyed by the crawlers that read it. This is why the product is not the tool to reach for if you want to test what an attacker with a foothold inside your network can do.
It will abstain rather than guess
A check that cannot reach a verdict records that and moves on. A backend check runs only against a project you pasted a key for or one you have connected — never because a fingerprint suggested you might be using that backend.
It will not blame you for its own failure
If a check throws, that is recorded as our error, not your finding, and the pillar it belongs to is marked provisional. A partly broken instrument is never presented as a measurement.
FAQ
Questions a
comparison should answer
Including the ones that end with ‘so this is not the tool for me’, because several of them legitimately do.
So is this better than Nuclei or ZAP?
It is a different instrument. An infrastructure scanner and an active app scanner go deeper into one layer and require permission, setup and time; a read-only site scan goes wide across six pillars in seconds and requires that you paste a URL. The serious answer for a site you care about is both, and this page exists to say where each stops.
Why is there no competitor comparison table here?
Because the numbers in one go stale within a quarter, and they go stale in the direction that hurts a reader: a price that changed, a feature that moved behind a plan, a limit nobody verified. What does not go stale is what each kind of tool can observe from where it stands, so that is the comparison this page makes.
Does it scan my whole website?
One URL per scan, built from one fetch: its headers, HTML, cookies, TLS, DNS and robots.txt, run through 85 checks. That is an honest shape for a first look and a bad shape for a 2,000-page site audit — a crawler tool is the right answer there, and this page says so rather than competing with it.
Can it check the part behind my login?
No, and it will not try. Nothing in this product authenticates to your site. If the interesting findings live behind a session, the choices are an active scanner you are authorised to run, or the repository scan — which reads the code that implements those routes.
What do the numbers on this page describe?
Check counts, pillar counts and per-pillar breakdowns are read from the scan engine’s own registry at build time, alongside engine version 1.24.12. A check that stops existing leaves this page in the same commit as it leaves the engine.
What does it cost?
The account to run a scan is free — a code to your email, no card. Pricing is on its own page rather than here, because it is the part of a comparison page that rots.
The cheapest
comparison is a scan
Every tool on this page that reads a public URL can be judged by what it says about yours. 85 checks across 6 pillars, the raw value behind each finding, and one prompt that fixes them. Free account, no card.
Scan your site
ScanlyFix
Security, SEO and AI-answer-engine scanning for anything you put on the internet. Paste a URL, read the evidence, run the fix.
Home