Hosted web vulnerability assessment
Professional Website Security Scanning. Without Enterprise Overhead.
Run authorized security assessments across the websites you manage. Consolidate vulnerability findings, inspect supporting evidence, prioritize remediation, and produce clear PDF reports—from one hosted platform.
Built for developers, web agencies, and independent security consultants.
Only scan websites you own or are explicitly authorized to assess. Responsible Scanning Policy
Integrations: Nuclei · OWASP ZAP (passive) · HTTP/TLS checks
One workspace for every site you assess.
Assess the sites you manage
Keep verified customer domains and assessments organized in one workspace.
Consolidate scanner findings
Review results from approved security checks without juggling disconnected scanner outputs.
Deliver reports with evidence
Share severity, affected URLs, technical observations and remediation recommendations in a readable PDF.
Platform
See the evidence. Know your next step.
The page loads a jQuery version with published cross-site scripting advisories. Whether the site is exploitable depends on how it uses the affected functions, so review usage before treating this as a confirmed vulnerability.
/*! jQuery v1.12.4 | (c) jQuery …
Upgrade to a supported jQuery 3.x release and test dependent plugins. Then rescan to verify.
One workspace, many targets
Switch between verified domains. Each keeps its own scan history.
Severity, confidence, verification
Three separate fields, so a high-severity detection isn't mistaken for a confirmed one.
Evidence and a next step
The request, the response excerpt, the source check and a recommended fix.
The page loads a jQuery version with published cross-site scripting advisories. Whether the site is exploitable depends on how it uses the affected functions, so review usage before treating this as a confirmed vulnerability.
/*! jQuery v1.12.4 | (c) jQuery …
Upgrade to a supported jQuery 3.x release and test dependent plugins. Then rescan to verify.
Scanning capabilities
Defined coverage for each scan profile.
Quick
Lightweight, passive checks with a low request volume. A safe first scan for any verified target.
Standard
Adds curated Nuclei vulnerability checks, with bounded request rates and timeouts.
| CHECK | QUICK | STANDARD |
|---|---|---|
| HTTP/security headers | Planned | Planned |
| TLS/certificate analysis | Planned | Planned |
| Passive OWASP ZAP assessment | Planned | Planned |
| Curated Nuclei vulnerability checks | Not included | Planned |
| Consolidated report / PDF | Planned | Planned |
Exact coverage depends on the scan profile, target behavior and permitted templates. Automated scans do not replace manual testing. What each engine checks.
Not in the first release: active ZAP scanning, authenticated testing, port scanning and scheduled rescans.
Reports
PDF assessment reports you can hand to a client.
- Scope, date and methods
- Severity, confidence and verification shown separately
- Affected URL and supporting evidence for each finding
- Concrete remediation guidance
- Partial-stage warnings and scan limitations
External, unauthenticated scan. Automated results may include false positives and miss issues, and do not replace manual testing.
/*! jQuery v1.12.4 …
Upgrade to a supported jQuery 3.x release, test dependent plugins, then rescan to verify.
How it works
A repeatable workflow for every assessment.
Add and verify your targets
DNS verification plus confirmation that you’re authorized to assess each domain.
TXT _scanbastion=7f3a…Select a scan profile
Quick or Standard, each with defined coverage and bounded traffic.
Run controlled assessments
Follow progress and stage status, and stop a scan at any point.
Review and deliver
Triage findings by confidence and evidence, then export a PDF.
shop-example-com-2026-10-21.pdf
Responsible scanning
Scan only what you're authorized to, with controls on every run.
Design goals for the first release. The full Responsible Scanning Policy sets out the rules in detail.
Verified ownership
No scan starts until domain control or authorization is confirmed.
Controlled scan profiles
Each profile has defined checks, so you know what will run.
Rate limits
Request rates stay bounded to keep load on the target predictable.
Timeouts and stop controls
Scans end on a timeout, and you can cancel at any stage.
Reviewable findings
Automated detections stay marked for review until a person confirms or dismisses them.
A simpler way to assess website security is on its way.
Join early access to hear when ScanBastion is ready for initial users.
✓ You're on the list.
We've sent a confirmation link to . We'll only email you about early access.
We'll email when early access opens. We'll only email you about early access.
FAQ
Questions from agencies and consultants
Can I scan websites for my clients?
Yes, as long as each client domain is verified or you have the owner’s explicit authorization to assess it. Client sites are planned to sit alongside your own targets in one workspace.
What authorization is required?
You’ll verify control of a domain with a DNS TXT record. If you don’t control the domain, you’ll need the owner’s explicit permission. The rules are set out in our Responsible Scanning Policy, which will be finalised before launch.
Which scan engines and profiles will be available?
Two profiles are planned. Quick covers HTTP security headers, TLS/certificate analysis and passive OWASP ZAP analysis. Standard adds curated Nuclei checks. Active ZAP scanning, authenticated testing and port scanning are not part of the first release. Each engine is described on the scan engines pages.
Can I manage multiple domains?
Yes. Managing several verified targets from one account is a core part of the planned first release.
How is this different from a WordPress security plugin?
A plugin runs inside one site and focuses on that platform. ScanBastion is planned to assess sites externally, the way a visitor reaches them, whatever they’re built with, and to keep results for several sites in one place.
How reliable are automated detections?
Automated scanners can report false positives and miss real issues. Each finding will show a confidence level and a verification status, and stays marked "Needs review" until a person confirms it or marks it as a false positive.
Is this a replacement for a manual penetration test?
No. Automated scanning finds common vulnerabilities and misconfigurations. A manual penetration test goes much further.
Can I share an assessment report with a client?
PDF export is planned for the first release. Reports are planned to include scope, date, methods, findings with evidence and remediation, and the limitations of the scan.
How much will it cost?
Plans are priced per verified target with scans included, starting with a free Starter tier and Solo at a proposed $19 a month for five targets. Prices are proposed and will be confirmed before launch. See the proposed pricing.
When will ScanBastion launch?
We haven’t set a launch date yet. Join early access and we’ll email you when it’s ready for initial users.