DIY Scanner vs Manual Security Audit: What You Get

Originally published on the Bug Circuit blog.

A free scanner is a great first move but it only reliably catches known, signature-based issues — missing security headers, outdated software versions, weak TLS config, exposed files — while a professional manual audit is built to catch what scanners structurally can't: broken authentication logic, access-control flaws, and chained vulnerabilities specific to how your site actually works.

Who this is for: you run a small business website — WordPress, Shopify, or a custom app — and you're trying to decide whether a free scan is "good enough" or whether you should pay for a human to look at it. What you'll get: an honest breakdown of exactly what each approach finds and misses, a comparison table, and a step-by-step way to run a solid free scan yourself before deciding if you need more.

How a DIY scanner actually works

Automated scanners work by sending your site a large list of known test cases and pattern-matching the response. A scanner like OWASP ZAP or a hosted tool checks things such as:

• Which HTTP response headers are present (e.g., Content-Security-Policy, Strict-Transport-Security)
• Whether your TLS/SSL certificate is valid and uses modern protocols
• Whether your software (WordPress core, plugins, themes, server software) matches a known-vulnerable version listed in a public database like NVD
• Whether common files are exposed (.env, wp-config.php.bak, .git/)
• Basic injection patterns — appending things like ' or <script> to input fields and watching how the response changes

This is genuinely useful work. It's fast, free or cheap, and it catches the low-effort issues that make a site an easy opportunistic target. Run one before you do anything else.

Try it yourself right now

1. Check your response headers: curl -I https://yoursite.com, or use our security headers checker to see what's missing at a glance.
2. Check your TLS setup with Qualys SSL Labs — aim for grade A.
3. Check whether your email domain can be spoofed with our email spoofing checker. You want a valid SPF record like v=spf1 include:_spf.google.com ~all and a DMARC record such as v=DMARC1; p=quarantine; rua=mailto:[e-mail].
4. Comfortable with a terminal? Run a baseline OWASP ZAP scan: docker run -t zaproxy/zap-stable zap-baseline.py -t https://yoursite.com.
5. For a free, no-cost recurring scan, CISA runs a scanning service for organizations — details at CISA Cyber Hygiene Services.

What scanners structurally can't see

This is the part that matters most when you're asking whether a free scanner is enough. Scanners test patterns, not intent — they have no idea what your site is supposed to do, so they can't tell when it's doing something it shouldn't. OWASP's own testing guidance is explicit that this category, business logic flaws, generally can't be found by automated tools because each one is specific to how a particular application works (see the OWASP Web Security Testing Guide).

Concretely, an automated scanner will almost never catch:

• Broken access control — e.g., changing /account?id=1042 to /account?id=1043 in the URL and viewing someone else's order or invoice. This is the #1 category in the OWASP Top 10.
• Authentication logic flaws — a password reset token that never expires, or that leaks in a Referer header to a third-party script.
• Privilege escalation through legitimate features — a "team member" role that can, through some multi-step form, quietly grant itself admin access.
• Chained vulnerabilities — three individually low-severity issues that combine into a full account takeover.
• Context-specific data exposure — an API endpoint that returns more fields than the page displays, including ones a scraper or competitor would want.
• Payment or discount logic abuse — applying a coupon code twice, or editing a price field in the browser before checkout.

None of these trip a signature. They require a person who understands your specific site to think like an attacker and actually try to break the logic, not just scan the code.

Side-by-side: what each approach actually delivers

	Free/DIY scanner	Manual audit (e.g., Circuit, $49)
Missing security headers	Yes	Yes
Outdated software / known CVEs	Yes	Yes
Weak TLS/SSL configuration	Yes	Yes
Exposed config or backup files	Yes	Yes
Broken access control (viewing others' data)	Rarely	Yes
Authentication/session logic flaws	Rarely	Yes
Business logic abuse (pricing, coupons, roles)	No	Yes
Chained, multi-step exploit paths	No	Yes
False positives to sort through yourself	Often, several	Verified by a human first
Fix instructions	Often generic	Specific to your site, with evidence
Time to results	15–60 minutes, self-serve	You wait for the write-up
Typical cost	Free to ~$50/month for tools	$49 one-time

Is a free vulnerability scanner enough?

For a lot of very small, low-stakes sites — a brochure site with no login, no payments, no stored customer data — a good free scan plus fixing what it finds is genuinely enough. It'll catch the missing headers, the outdated plugin, and the weak TLS setting, which covers most of the realistic risk for that kind of site.

It stops being enough the moment your site has a login, stores customer data, takes payments, or has more than one user role — customer vs. admin, free vs. paid tier, and so on. That's exactly the point where the vulnerabilities that matter most — the ones that lead to an actual data breach rather than a cosmetic defacement — are the logic flaws a scanner structurally can't see. Our guide on manual vs. automated penetration testing goes deeper into where that line sits for different types of sites.

A realistic workflow, not a competition

1. Run a free scan first — headers, TLS, known CVEs, exposed files — and fix everything it flags. This is cheap, fast, and removes the low-hanging fruit an opportunistic attacker is scanning the whole internet for.
2. If your site only serves static content with no accounts, you're probably done for now. Re-scan every few months or after major changes.
3. If your site has logins, payments, customer data, or multiple user roles, get a human to look at the logic — that's the gap scanners can't close. A free passive check will also give you a quick yes/no read on whether anything critical is visible before you decide to pay for anything.
4. Not sure which category you're in? Our guide is my website hackable? walks through the questions to ask.

What a $49 manual audit actually includes

Scope matters for trust here. A $49 productized audit like Circuit is a real person manually reviewing your site's attack surface, authentication flows, and common business-logic paths, then handing you a written report — each finding with severity, evidence, and the exact fix. It is not a multi-week enterprise penetration test, and it is not a compliance certification (SOC 2, PCI-DSS, and ISO 27001 audits are separate, much longer engagements). For a small WordPress site, Shopify store, or indie SaaS, it's scoped to catch what actually threatens a business your size: account takeover, data leakage, and the issues a free scanner already surfaced but couldn't confirm were real.

Key takeaways

• Run a free scanner first — it cheaply catches missing headers, outdated software, weak TLS, and exposed files.
• Scanners test known patterns; they can't evaluate whether your site's specific logic — access control, auth, pricing, roles — can be abused.
• If your site has no login, no payments, and no customer data, a good free scan is likely enough on its own.
• The moment accounts, payments, or user roles exist, get a human to test the logic, since that's where real breaches happen.
• Treat scanning and auditing as sequential, not competing: scan first, fix what it finds, then get a manual review for anything that handles real user data.

Run the free tools above yourself today — they cost nothing. If your site has logins or customer data and you want someone to actually try to break in the way an attacker would, Circuit is a $49 one-time manual audit from a real person, with a full written report — no card required to start with the free passive check first.