Most free security scanners either miss everything or cry wolf on nothing. Here's what small businesses should actually be checking — and what free tools get it right.
You Google "free website security checker" and get 40 results. You paste in your domain. Twenty minutes later you're staring at a 12-page report full of red flags — and you have no idea which ones actually matter. So you ignore all of it. That's exactly what the false-positive problem wants you to do.
The tools that actually work for small businesses aren't the loudest. They're the most targeted. Here's how to find the ones worth your time, and what to check yourself right now without spending anything.
Free scanners fall into three categories:
None of these actually help you find the real vulnerabilities that an attacker would exploit. What you need is a scanner that understands the difference between a theoretical weakness and an actually exploitable issue.
Before you run any scanner, know what you're looking for. The vulnerabilities that actually put small businesses at risk fall into a specific pattern:
If your site accepts user input and talks to a database, SQL injection is the first thing to check. A successful SQL injection can give an attacker full access to your database — customer data, passwords, payment records. The freely available SQLMap tool automates detection, but you need someone who understands what they're looking at to interpret the results. A better option: run it through a structured scanner that tells you exactly which parameter is vulnerable and what the actual risk is.
XSS lets an attacker inject scripts into pages your users see. This is how session tokens get stolen, how phishing links get planted in your own domain, and how drive-by downloads happen. Small businesses often think "we're too small to be targeted" — but XSS exploitation is largely automated. Bots scan millions of sites looking for XSS entry points regardless of size.
Modern web apps expose APIs everywhere. An API is just a URL that accepts data and returns a response. Many of those endpoints were built for internal use and were never meant to be public — but they're accessible anyway. Check if your site has API endpoints that aren't documented, aren't authenticated, or return more data than they should.
Your main domain is probably protected. But your staging environment? The dev server your developer set up two years ago and forgot about? The old admin panel that's still live? Those subdomains often have weaker security, and an attacker who finds them can use them as entry points into your infrastructure. Finding all your subdomains before an attacker does is one of the highest-value security checks you can do.
Based on practical testing, these are the tools that give you real signal without the noise:
If you have access to someone technical on your team (even a developer friend), here's the minimum viable security check for a small business website:
Go to ssllabs.com/ssltest and enter your domain. If you get below a B, that's a real problem that needs fixing. Below a C means you have known-vulnerable TLS versions enabled — fix that immediately.
amass enum -passive -d yourdomain.com — this pulls all known subdomains from public data sources in about 5 minutes. Anything you didn't know about is a potential blind spot.
Go to yourdomain.com/admin, /login, /wp-admin, or similar paths. If they're accessible without VPN and don't have rate limiting or IP-based protection, they're likely being scanned by bots right now. Check your server logs — you'll probably find thousands of automated login attempts every week.
Most scanners flag missing security headers as critical. In reality, a missing Content-Security-Policy header on an informational marketing site is a low priority. The same header missing on a web app that handles auth tokens is a real issue. Context matters.
When you get a scan report with dozens of findings, sort by these three questions before prioritizing:
If you don't have the internal expertise to answer those questions, find a scanner that provides contextual prioritization instead of just a raw list of findings.
Security doesn't have to mean an enterprise budget. The checks above are free and will take you less than an hour. Do them today.
You don't need an enterprise budget to find the vulnerabilities that matter.
Browse Free Security Tools →