Free security scanner
Is my VPS secure?
Run a comprehensive security check on your server in seconds. Identify open ports, SSL issues, missing headers, and common misconfigurations.
Security scanner
Enter your server IP or domain to check for common security vulnerabilities.
Deploy securely with temps.sh
Managed deployments with security best practices built in
What we check
Eight non-intrusive checks covering the misconfigurations that expose most self-hosted servers.
Open Ports
Dangerous ports like FTP, Telnet, databases
SSL/TLS
Certificate validity and TLS version
HTTP Headers
Security headers like HSTS, CSP
Databases
Exposed MySQL, PostgreSQL, Redis, MongoDB
Email Security
SPF, DKIM, and DMARC records
SSH Config
Default port detection
Visibility
Network fingerprinting exposure
Risk Score
Overall security grade A-F
About this tool
- All scans are non-intrusive and use standard connection methods
- We never store your IP address or domain with scan results
- Results are cached for 1 hour and then deleted
- Private and internal IP addresses are blocked for security
- Rate limited to 3 scans per hour to prevent abuse
Common questions
- Is it safe to scan a production server?
- Yes. Every check opens a standard connection the way an ordinary client would — it reads what your server already advertises publicly and never attempts to exploit anything it finds. There is no traffic flood: scans are rate limited to three per hour per visitor.
- What does the A–F grade actually measure?
- The grade summarises every check on this page into one score: which ports answer, whether your TLS certificate is valid and current, which security headers are present, whether a database port is reachable from the open internet, and whether SPF, DKIM and DMARC records exist for your domain.
- Do you keep my IP address or domain?
- No. Results are cached for one hour so a refresh does not trigger a second scan, then deleted. The cached result is not stored alongside the IP address or domain it came from, so there is no scan history tied to you.
- Why was my internal IP address rejected?
- Private and internal ranges are blocked deliberately. Allowing them would turn a public scanner into a way of probing networks it cannot see, so only publicly routable addresses and domains are accepted.
- Which finding should I fix first?
- A database port reachable from the internet — MySQL, PostgreSQL, Redis or MongoDB — is the most urgent, because it exposes data directly rather than a service in front of it. Legacy plaintext protocols such as FTP and Telnet come next, then expired or missing TLS, then absent security headers.