Free Scan
A$0
Review publicly visible website and domain signals. Receive a score and summary without payment details.
Run the free scanThreatScout by ScoutLab
Website Vulnerability Assessment for Australian Businesses
ThreatScout is an automated website vulnerability scanner that assesses externally visible security weaknesses, configuration issues and attack-surface signals from outside your website. It gives Australian businesses a structured vulnerability assessment without installing software or requiring server access. It is not a substitute for a comprehensive manual penetration test where one is required.
Run a Free Website Security Scan
See what your website may be exposing from the outside.
Choose the next step for your website
Start with free external evidence, read the full findings, add authorised testing or track changes over time. All prices are in Australian dollars.
Unlock Full Report
A$99 one-time
Read the full findings from your existing Free Scan. Unlocking the report does not add testing. Choose this on your scan report.
Start a scan to unlock its reportDeep Scan
A$199 one-time
Add authorised active external testing within your confirmed scope, plus Full Report access. Purchase from your scan report; confirm scope before testing starts.
Review Deep Scan coverageMonitoring
A$199/month
Repeat external checks on a schedule and compare observations over time. For ongoing visibility after establishing a baseline; it does not block attacks or fix findings.
Explore recurring monitoringAlready unlocked this scan? Your A$99 Full Report payment is credited towards its A$199 Deep Scan, leaving a standard A$100 balance. A new scan has its own purchase choices. Automated external checks cannot guarantee security or replace manual penetration testing.
The basics
What is a website vulnerability scanner?
A website vulnerability scanner is an automated tool that reviews an internet-facing website for observable security weaknesses and configuration issues. The results form part of a website vulnerability assessment: a structured view of how your website responds to the internet, including encryption settings, security headers, domain records, exposed services and other externally visible signals.
Because everything is observed from outside, no software is installed and no access to your server, hosting account or CMS is needed. The assessment simply requests the same information that any browser, bot or attacker could request, then compares what it finds against commonly recommended configuration.
An automated assessment is best understood as a way to find the areas that deserve investigation. It is not proof that a website is completely secure: weaknesses inside application logic, internal systems or business processes are not externally observable, and some findings need further validation before they can be judged. Used that way, an assessment gives you a defensible starting point rather than a false sense of certainty.
Assessment coverage
What can a website vulnerability scanner identify?
ThreatScout groups its findings into categories that reflect what can genuinely be observed from outside your website. Your own results depend entirely on your website, its platform and how it is configured.
SSL/TLS and HTTPS configuration
Whether your website is reachable over HTTPS, how the encrypted connection responds, and whether certificate details can be assessed from outside.
Security headers
Whether commonly recommended headers are returned — HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options and Referrer-Policy.
DNS and domain security signals
Whether your domain resolves as expected and how its publicly visible records are configured.
Email protection records
Whether SPF, DKIM and DMARC records are published for your domain, and whether a DMARC policy is enforced.
Publicly exposed services
Externally reachable services and endpoints associated with your domain that may add avoidable attack surface.
Technology and configuration exposures
Website technologies and configuration responses that are visible externally and differ from commonly recommended settings.
You can see these categories applied to your own domain with the free website security scan.
Why it matters
Why website vulnerabilities matter
For most Australian small and medium businesses, the website is the system with the widest exposure and the least routine review. Outdated software, weak configuration, unnecessary exposed services or missing security controls give an opportunistic attacker more to work with than a well-configured site does — and these are usually inexpensive to correct once you know about them.
Websites are internet-facing systems that are reachable by anyone, at any time
Software, plugins and CMS versions age, and known issues emerge after launch
Configuration drifts as different people make changes over months and years
Hosting or platform migrations can quietly reset security settings
New integrations and DNS edits can expose services that were never intended to be public
Security controls that were never enabled remain missing until someone checks
Comparison
Vulnerability assessment vs penetration testing
These are related but different activities, and they answer different questions. Many businesses use assessments for ongoing visibility and commission a penetration test when deeper assurance is required.
Purpose
- Vulnerability assessment
- Identify potential weaknesses broadly across an internet-facing website
- Penetration test
- Validate weaknesses and test how far they could realistically be taken
Level of automation
- Vulnerability assessment
- Largely automated checks against observable signals
- Penetration test
- Led by a human tester, supported by tooling
Depth
- Vulnerability assessment
- Breadth over depth — surfaces areas that warrant investigation
- Penetration test
- Deep, targeted examination within an agreed scope
Manual testing
- Vulnerability assessment
- Minimal; findings may need further validation
- Penetration test
- Central to the engagement, including controlled exploitation attempts
Typical use
- Vulnerability assessment
- Regular visibility of external exposure and a starting point for prioritisation
- Penetration test
- Assurance, compliance obligations or high-risk applications
Relative accessibility
- Vulnerability assessment
- Fast to arrange and accessible to smaller businesses
- Penetration test
- A scoped professional engagement requiring more time and budget
To be clear: ThreatScout is an automated external security assessment. It should not be represented as a complete manual penetration test, and it does not replace one where a penetration test is required. For authorised active external testing beyond the free surface scan, review the ScoutLab Deep Scan.
The process
How to scan a website for vulnerabilities
1
Enter the website you want assessed
Provide the domain you are responsible for. Nothing is installed and no server, hosting or CMS access is required.
2
ThreatScout scans the website from the outside
The assessment reviews the security signals your website and domain already publish to the internet.
3
Results are analysed and organised
Findings are assessed, grouped by category and severity, and written up in a security report you can actually read.
4
You decide what needs attention
Review the findings in your own business context and choose what to investigate further or raise with whoever looks after your website.
ScoutLab averages 320+ businesses scanned per month across Australia.
Suitability
Who should consider a website vulnerability assessment?
Australian small and medium businesses without a dedicated security team
Businesses running a customer-facing website
Organisations that accept enquiries or customer information online
Ecommerce businesses handling orders and customer accounts
Businesses preparing for a website launch or a significant update
Organisations that want an external view of their website security posture
Businesses that have not reviewed their website security recently
Timing
How often should you assess your website?
There is no universal interval that suits every business. In practice, the useful trigger is change: whenever your website or its supporting configuration changes meaningfully, what it exposes to the internet may have changed too.
Major website changes or a redesign
Platform or CMS upgrades
Hosting or infrastructure changes
Significant configuration or DNS changes
New integrations, plugins or third-party tools
After a security incident
When an important vulnerability affects a technology you use
Reassessing periodically also helps you see how your externally visible exposure shifts over time, rather than relying on a single point-in-time snapshot. For ongoing visibility after an assessment, learn more about website security monitoring. If you are weighing automated checks against a manual engagement, read what an automated cyber security assessment can and cannot assess.
Next steps
What happens if a vulnerability is identified?
Findings should be reviewed together rather than in isolation. Technical severity is one input; the others are your business context and how exposed the affected component actually is. A finding on a critical customer-facing system usually deserves attention before the same finding elsewhere.
It is also worth noting that not every automated finding is automatically exploitable. Some are clear configuration gaps that can be corrected quickly; others are indicators that require additional investigation or validation before you can judge their real significance. ScoutLab reports what was observed and how serious it appears — deciding and implementing the change sits with you and your technical support.
Your web developer or web agency
Your internal IT team
Your IT provider or managed service provider
Your hosting or platform provider
A cyber-security specialist for more complex findings
Learn more
Website vulnerability scanning guides
Use these plain-English guides to understand how external vulnerability scanning fits into a broader website security programme before or after you run an assessment.
FAQ
Website vulnerability assessment FAQs
Which assessment should I choose for my website?
+
Use the A$0 Free Scan for an initial view of public website signals. A$99 unlocks the full findings from that scan, while the A$199 one-time Deep Scan adds authorised active external testing. Purchase choices appear on your scan report. Choose manual testing from a qualified provider when authenticated workflows, business logic or source code need assessment.
What is a website vulnerability assessment?
+
A website vulnerability assessment reviews an internet-facing website for observable security weaknesses and configuration issues — things like HTTPS and TLS settings, security headers, public DNS and domain records, and externally visible services. The goal is to understand what your website is publishing to the internet and which areas deserve a closer look.
Is a vulnerability assessment the same as a penetration test?
+
No. A vulnerability assessment identifies potential weaknesses broadly and efficiently, usually with automation. A penetration test is a manual engagement in which a tester validates weaknesses and attempts controlled exploitation within an agreed scope. ThreatScout is an automated external assessment, not a substitute for a manual penetration test where one is required.
Can an automated scan find every website vulnerability?
+
No. An automated external assessment only observes what is visible from outside your website. Issues inside application logic, internal systems, staff processes or code that is not externally observable will not appear. A clear result is a good signal, not proof that a website is secure.
Do I need technical knowledge to understand my results?
+
No. ThreatScout findings are written in plain English alongside the technical detail, so a business owner can understand what was detected and share it with whoever looks after their website.
How often should a business assess its website?
+
There is no universal interval. Many Australian businesses reassess after significant website, platform, hosting or DNS changes, and then periodically to see whether their externally visible exposure has shifted over time.
Can I scan my website for free?
+
Yes. ScoutLab offers a free website security scan that runs entirely from the outside — no account, installation or server access required. You receive a ThreatScout score and a summary of what was detected.
What should I do if a vulnerability is found?
+
Review each finding based on its technical severity, your business context and how exposed the affected component is. Some findings need further investigation or validation before action. Your web developer, IT provider, hosting provider or a cyber-security specialist is usually the right person to make the change.
What is a website vulnerability scanner?
+
A website vulnerability scanner is an automated tool that checks an internet-facing website for observable security weaknesses and configuration issues. ScoutLab reviews externally visible signals such as HTTPS and TLS configuration, security headers, public DNS and domain records, email protection records and reachable services.
How do I scan my website for vulnerabilities?
+
Start with an authorised external scan of a website you own or are responsible for. ThreatScout assesses the security signals the website and domain expose publicly, organises the findings by category and severity, and gives you a report to review. Automated scanning is a useful starting point but does not replace manual penetration testing when deeper assurance is required.
See what your website is exposing
The simplest place to begin is ScoutLab's free website security scan. It gives you an external view of your current website security posture in plain English, so you know which areas are worth a closer look before anything else.