Know your vulnerabilities
before attackers do.
HScan is a professional website and web application vulnerability scanning service. Submit your domain, verify ownership, and receive a comprehensive security report — no technical knowledge required.
How it works
Four straightforward steps from sign-up to security report.
Register & Add Your Domain
Create an account and submit the website or web application you want scanned. No agents or software installations required on your end.
Verify Domain Ownership
We'll provide a unique DNS TXT record to add to your domain. Once verified, we confirm you have the authority to request a scan — keeping the process secure and compliant.
We Scan
Our team runs a thorough vulnerability assessment using industry-standard scanning tools. No automated-only results — real scanners, properly configured.
Receive Your Report
You get a detailed, actionable vulnerability report covering all findings, severity ratings, and descriptions of each issue — ready to share with your development team.
What we scan for
Our scans cover a wide range of vulnerabilities across the OWASP Top 10 and beyond, using professional-grade tools configured by our security team.
- Injection vulnerabilities (SQL, command, LDAP)
- Cross-site scripting (XSS)
- Broken authentication & session management
- Security misconfigurations
- Sensitive data exposure
- Insecure direct object references
- Cross-site request forgery (CSRF)
- Outdated & vulnerable components
- Server-side request forgery (SSRF)
- Business logic vulnerabilities
Powered by professional tools
We use industry-standard scanning tools trusted by security professionals — so you don't need to worry about what's under the hood.
What you receive
- Full vulnerability report (PDF + web)
- Severity ratings: Critical, High, Medium, Low, Info
- Affected URLs and evidence for each finding
- Remediation guidance for each vulnerability
Scope
HScan covers websites, web applications, and APIs accessible over HTTP/HTTPS. Scans are performed against the domain you verify — no more, no less.
Frequently asked questions
How long does a scan take?
Scan duration depends on the size and complexity of your website. Most scans are completed within 24–72 hours. You'll be notified by email when your report is ready.
Will the scan affect my website's performance?
We schedule scans carefully and can work around your preferred time window if needed. For most sites the impact is minimal, but we recommend scanning on staging environments for mission-critical applications.
Why do you require a DNS TXT record?
Domain verification ensures we only scan websites and applications that you own or are authorized to test. This protects third parties and keeps HScan compliant with responsible disclosure standards.
What tools do you use?
We use industry-standard scanning tools used by security professionals, configured and operated by our team. You get the results without needing to know anything about the tooling.
Do you fix the vulnerabilities you find?
Currently we provide the report and findings only. We are exploring partnerships with remediation specialists and will offer that option in the future. Your development team can use the report to prioritize and address each issue.
What kind of report do I receive?
A detailed PDF and web report with each vulnerability's name, severity (Critical / High / Medium / Low / Informational), affected URL, description, evidence, and remediation guidance.
Ready to scan your website?
Get in touch to request a scan. We'll walk you through the domain verification and get your report delivered.
Request a Scan