Scan the visible vulnerabilities of your web application

The scan looks for signals observable on the public surface: encryption settings, certificates, browser policies, exposed technical information, subdomains and email protections. The exact detail depends on the level of analysis authorized.

Before any analysis that may go beyond passive observation, PentestLouis asks you to prove control of the domain and accept the scope. This step prevents a user from triggering tests against an application that does not belong to them.

For active testing, a realistic staging environment remains the recommended target. Production environments require stricter scoping and an understanding of the possible impacts.

A missing header does not have the same impact depending on how the application behaves. Conversely, a vulnerable dependency becomes more urgent when a matching component is exposed. The diagnostic’s value comes from that correlation, not from a long list of independent checks.