WebScan finds the public face of your organisation — including the hosts nobody wrote down — and grades it against the published standards that define it. TLS, HTTP headers, cookies, DNS, exposed services, content and infrastructure. No tenant, no consent, no agent: it sees what an anonymous visitor sees.
The outside is the only half of your posture an attacker can assess without credentials — and the only half a prospective customer can check before they sign anything. It is also the half that usually gets looked at once a year, by a different tool, and filed as a PDF that is wrong within the month.
Nothing here is exotic. Weak TLS, a missing CAA record, a cookie without Secure — every
one is a known standard, publicly specified, and trivially checkable from outside. Which is exactly
why being wrong about them is hard to explain afterwards.
security.txt, open ports and services reachable from outside, and what your server
volunteers about itself.Each scan is a short-lived Azure Function. Nothing is installed, nothing runs inside your tenant, and on the free tier nothing is written down when the scan finishes — which is precisely what makes it free to give away. It is also why free scans are on demand only: nothing schedules itself, so a free scan costs what it costs and then stops.
The free tier runs one URL at a time and keeps nothing, which is what lets it stay free indefinitely rather than becoming a trial. It is also authenticated — an anonymous scanner aimed at domains the caller does not own is reconnaissance run from our addresses, and that ends with our egress ranges on a blocklist and somebody else's abuse report.
Not a penetration test. WebScan grades configuration against published standards; as it stands it does not attempt exploitation and cannot see anything behind a login. Active testing and authenticated scanning are on the roadmap — until they ship, this paragraph is the accurate description.
What will not change: it never writes — not to your DNS, not to your web server. DNS write-back belongs to MailTrust, which also owns SPF, DKIM and DMARC. Those are mail authentication rather than web surface, and they will not be duplicated here.
The screen you will actually work in.
Not a letter and a list of red crosses. Every failure carries the standard it breaks, why that matters, the fix, and — if you are not going to fix it — somewhere to say so.
Passed, failed, not assessed and not applicable are kept apart. A check that could not run is never folded into either column — a grade that hides its own gaps is worse than no grade.
Domain replaced in the screenshot. The findings are the real ones.
| Capability | What it means for you |
|---|---|
| Unauthenticated, from outside | No consent to arrange; a licensed site can be one you do not own yet |
| Standard references on every check | The finding is a specification, not an opinion |
| Four result states, kept apart | An unreadable check never becomes a quiet pass |
| Scheduled scans and retained history | Proof the configuration held between audits |
| Waivers with mandatory expiry | Accepting a risk is recorded and re-surfaces, not buried |
| Control tags into CompliancePortal | The external surface becomes evidence with no second integration |
| Fleet view across domains and tenants | Rank a client book by public exposure in one screen |
They do, well. Then they forget, and the result lives in a browser tab. WebScan's difference is not the check — it is that the result is kept, tagged to a control, and sits next to the rest of your posture instead of in someone's bookmarks.
A penetration test is a date. Certificates expire, headers get dropped in a deploy, a new subdomain appears. This is the part of that report that should have been a schedule.
Not in what it checks — the check set is identical and so is the result. It is capped in reach: one URL at a time, and it forgets. Nothing is held back to make the paid version look cleverer; what you buy is the memory.
It requests pages and reads DNS the way any visitor does. No exploitation, no fuzzing, no load. If a scan could take your site down, an ordinary crawler already would have. Should active testing ever ship — it is on the roadmap — it will be a separate, explicitly consented mode, never something the default scan starts doing.
Your own, free, three times a day. You will see exactly what the licensed version would have recorded — the difference is what happens to it afterwards.
The free tier is a complete scanner, not a teaser — every check, every result, on one site three times a day. What it does not do is remember, and remembering is the whole of the paid product. Two licences: scan it, or keep it.
On every tenant, automatically
Every check, every result — one URL at a time, fire and forget. Nothing is withheld from the check set; what it does not do is remember. When you close the page it is gone: no history, no evidence, nothing watching between scans.
Discovery is not part of free, and not as a lever: it is an inventory of what appeared and when, so it needs a saved site to attach to and a yesterday to compare against. Free has neither.
Good for: checking a site whenever you want to know. Proving a fix landed. Deciding whether Pro is worth it on evidence rather than on a demo.
Per monitored site
The site becomes something we remember, and something that re-scans itself on a cadence you set. Runs are retained, history plots, findings and waivers exist, the audit trail records who decided what, and control tags carry into CompliancePortal.
It also starts the daily watches: a certificate expiring in thirty days is a fact that arrives on a clock, not on a scan. Those read stored data and send nothing to your site — which is why they need a saved site to exist at all, and why free cannot have them.
Discovery is included and never billed. Hostnames found under a site you already pay for cost nothing and are listed, not scanned — the name, whether it still resolves, and where it pointed. Turning one into a monitored site is your decision and a button; only then is it scanned, and only then does it count.
Keeping a scan and scheduling it used to be separate tiers. That sold a distinction nobody actually makes: a saved site nobody re-scans is a stale record, and a schedule that keeps nothing is a cron job with no output. Pro grants both, and there is nothing between them worth charging for.
Everything below is something a competing tool does today and WebScan does not. It is written here rather than discovered during an evaluation. None of it is built, none of it is dated, and none of it is included in a licence you buy today.
WebScan reports the software a server discloses and the endpoints it can see. It does not yet join those facts to anything.
Both extend a check that already runs. CVE correlation also brings a vulnerability database to keep current, which is a maintenance commitment rather than a feature.
A change in kind, not degree, and the one to be most careful about — it brings false positives, scan windows and permission-to-test paperwork with it.
If these arrive they will be an explicit, separately consented mode. The free tier stays what it is now: unauthenticated, non-intrusive, and safe to point at anything.
Things that say something about exposure without being a property of your web configuration.
The last would take WebScan into third-party risk management, a different buyer and a different product. It is listed because it was asked for, not because it is settled.
Comparison tables will show WebScan missing SPF, DKIM and DMARC. That is deliberate and permanent: mail authentication is MailTrust, on the same domains, feeding the same findings store. It is not absent from the platform — only from this product.