I've been building web, SaaS and enterprise systems for 25+ years. Somewhere along the way I got tired of "website checker" tools.
You know the ones. You paste a URL, wait, and get a friendly ~80 out of 100. Their idea of "security" is a green check next to "HTTPS". And the report is really a funnel — give us your email, book a call with our agency.
So I built the opposite: CheckWeb — a free website security scan with no sign-up, an honest score, and real CVE detection. Here's what I learned building it.
Quick definition, because I'll lean on it all the way through: a CVE (Common Vulnerabilities and Exposures) is a publicly catalogued security flaw, filed under an ID like CVE-2024-4439. If a library on your site carries one, the write-up is public — and usually so is the exploit.
1. Aggregate CVE counts lie
The first thing I got wrong: counting CVEs per package instead of per version.
jQuery has accumulated 8 CVEs over its lifetime. But if your site runs jQuery 1.8.2, only 5 of them actually affect that version — the rest were introduced later, or fixed before it.
Reporting "jQuery 1.8.2 — 8 known CVEs" is technically a lie, and exactly the kind of thing that destroys trust the moment a developer checks. So the scanner cross-references the detected version against the version ranges published by OSV (Open Source Vulnerabilities, Google's open database) and NVD (the US government's National Vulnerability Database) and counts only the CVEs whose affected range actually includes that version — with max severity computed over that same subset.
A scanner that cries wolf is worthless. Accuracy isn't a nice-to-have here; it's the whole product.
2. Honesty is a feature, not a liability
Every checker I tried handed almost every site something in the high 70s. It feels good. It says nothing.
I went the other way: an honest 0–100 score with hard gates. A broken or untrusted certificate caps the overall score at 50, no matter how fast and well-optimized everything else is. No HTTPS at all caps it lower. A blacklisted domain caps it too.
That means my scores are sometimes ugly. That's the point — a low score is the product's own argument. And if your site is clean, I'll tell you straight instead of inventing problems.
3. Passive-only is a hard line
The scanner reads only what your site shows any visitor: response headers, returned HTML, DNS, the TLS certificate, the library versions a page loads. It never probes hidden paths, scans ports, or sends payloads.
Partly that's a legal line — actively probing someone else's domain isn't something you get to do because you're curious. But it's also trust: I want anyone to scan any site without me doing something I'd have to apologize for. The deeper active checks only make sense on a domain someone has proven they own.
What it actually finds
Outdated JS libraries and CMS versions with known CVEs, missing or weak security headers, TLS and certificate problems, mixed content, insecure cookies, email spoofing gaps (SPF and DMARC — the DNS records that stop strangers sending email as your domain), blacklisting and Safe Browsing flags.
The most striking find so far: a live site running a WordPress core old enough to carry 158 known CVEs.
Where it stands
Early, free, no revenue. The passive scan stays free forever. Later I plan a paid deep audit + monitoring for people who verify their own domain — that's where the active checks (exposed files, open ports, admin panels) belong.
The ask
Scan a site you know well: https://chkweb.com
Then tell me: are the findings accurate? Does the score feel fair? Anything confusing or missing?
I'd rather hear it's wrong now than after a thousand people trust it. Brutal feedback very welcome.
Top comments (0)