See your domain the way the internet already does.

Yes, free to use, no account, and no signup. Every scan returns a full graded report; nothing is paywalled.

It only sends the same kind of requests a browser, a DNS lookup, or a certificate-transparency search already makes: it reads public pages, headers, DNS records, and JavaScript. It never sends exploit payloads, submits forms, brute-forces logins, or tries to break anything, so it won't disrupt or take down the target.

Scan domains you own or are explicitly authorized to test. Everything here is passive and uses public data, but you're still responsible for having authorization. Treat it like any other security testing.

Email spoofing protection (DMARC, SPF, DKIM, MTA-STS), TLS and protocol support, security headers, exposed files, and your client-side JavaScript for leaked keys, known-vulnerable libraries, downloadable source maps, and DOM-XSS sinks. It also maps your attack surface from certificate-transparency logs, checks for subdomain takeover, dead links, forgotten endpoints in the Wayback Machine, and lookalike domains. See what one scan looks at for the full list.

No. A penetration test actively exploits weaknesses to prove impact; this is a passive posture check that maps what's exposed and grades your configuration. It's a fast first look and a good ongoing hygiene check, but it complements a real pentest rather than replacing it. A clean grade here doesn't mean you have no vulnerabilities. Vitreo is a free product from Vullify, a vulnerability management platform; for continuous tracking and remediation of vulnerabilities across your assets, that's where Vullify comes in.

Each check is a finding (pass, warning, or fail) weighted by severity, from a starting score of 100 down to a letter grade (A+ to F). The report groups everything into sections and hands you a prioritized fix kit, worst first, so you know what to address before anything else.

There's no account and no tracking. "Recent scans" is scoped to your browser: a random token is saved in your browser's local storage and only your own scans show up in that list, so other visitors can't browse what you've scanned. Anyone with a scan's link (its UUID) can still open that one report, so only share it if you mean to. Reports are deleted automatically 72 hours after a scan finishes; download the JSON if you want to keep one. Clearing your browser storage forgets the token, so your past scans drop off the list.

Public domains only. IP addresses and internal or reserved names (localhost, *.internal, or anything that resolves to a private address) are rejected, which keeps the scanner from being pointed at internal networks it can't see.

Yes. Scans are rate-limited per IP address to keep the service fair for everyone, with a per-minute limit and a daily cap. If you hit one, you'll get a clear message telling you when you can try again. The exact limits for this instance are shown on the API reference.