about nzscan

nzscan is a free, fast, public-facing security smoke test. It looks at a website the same way your browser does — and reports the things your browser silently tolerates.

How it works

You give it a URL. nzscan makes a small handful of HTTP and TLS requests to that URL and grades what comes back. No third-party APIs, no paid data feeds, no exotic crawling.

What "smoke test" means

nzscan catches the cheap, embarrassing, easily-preventable misconfigurations that show up on real production sites every day: missing security headers, weak TLS, accidentally-public .env files, cookies missing flags. It is not a penetration test, vulnerability scan, or compliance audit.

Limits

• ×Single URL only
  Only scans the URL you give it — not the whole site.
• ×No login bypass
  Cannot see behind logins.
• ×No app-layer bugs
  Cannot detect SQLi, XSS in your code, or authz flaws.
• ×Single IP source
  Aggressive WAFs may rate-limit or block.

Only scan things you're allowed to

By using nzscan you confirm you own the target or have explicit permission to test it. Scanning third-party sites without authorisation may be illegal where you are.