Answers in minutes, not weeks
Paid assessments take days to schedule. Your free report is ready in about five minutes, so you can act today.
The security report others charge for · Free
Free website & app vulnerability scan. Your Sumrite report in 5 minutes.
Enter your website or upload your Android or iOS app. Sumrite’s free online vulnerability scanner checks it the way paid security assessments do and sends you a clear, board-ready report in about five minutes. No credit card, no sales call.
Use your work email on the same domain as the website. That is how we confirm it is yours.
5 min
Report in your hands
Free
The report others charge for
250+
Companies secured by Sumrite
What you get, free
What security firms charge for. Sumrite gives it to you free.
The automated checks that usually come inside a paid assessment, packaged into one clear report for your website or mobile app.
Doors you forgot were open
Forgotten subdomains, exposed services and test systems attackers find first.
Missing website protections
Gaps such as an absent Content Security Policy or weak cookie settings that leave customers open to attack.
Encryption you can trust
Weak or outdated encryption and certificates close to expiry, before they break trust or checkout.
Mobile app risks
Risky permissions, hard-coded keys and data stored or sent insecurely in your Android or iOS app.
A report your board can read
Plain-language risk ratings with clear next steps, ready to share with leadership, customers or auditors.
What the scanner checks
One free scan. Every check attackers run first.
Sumrite’s vulnerability scanner looks at your website and apps from the outside, the way an attacker sizes you up. It is passive and safe for live systems: no exploit payloads, nothing that can take your site down.
Website vulnerability scan
Your site, servers and domain
- Security headers: Content Security Policy, HSTS, X-Frame-Options, Referrer-Policy and cookie flags
- SSL/TLS: certificate validity and expiry, protocol versions and weak encryption
- Open ports and exposed services, such as databases or admin panels left on the internet
- Subdomain discovery from certificate transparency logs, including forgotten and test hosts
- DNS security: zone transfer (AXFR), DNSSEC, open recursion, dangling CNAMEs, SPF and DMARC
- Exposed API surface: OpenAPI and Swagger docs, GraphQL endpoints and security.txt
- Passive web application checks built on OWASP ZAP for common OWASP Top 10 weaknesses
- Internet exposure and technology fingerprinting from public OSINT sources such as Shodan
Mobile app security scan
Your Android and iOS builds
- Android .apk and iOS .ipa static analysis, no device or source code needed
- Dangerous permissions and exported components other apps can reach
- Hard-coded API keys, tokens and credentials inside the build
- Insecure network settings: cleartext traffic and weak certificate validation
- Weak cryptography and data stored on the device without protection
- A security score and attack-surface summary your developers can act on
How it works
Three steps to your free security report.
No account, no installation and no credit card. Most scans finish in about five minutes.
- 01
Enter your website or upload your app
Type your website address, or switch to Mobile app and upload your Android .apk or iOS .ipa build.
- 02
Confirm it is yours
Use your work email on the same domain as the website. That is how Sumrite confirms you own what you are scanning.
- 03
Get your report
Watch the checks run live. In about five minutes your risk-rated report is on screen, ready to download as a PDF and sent to your inbox.
Why experts still matter
Tools find the obvious. Experts find what costs you the deal.
Automated checks see the surface. Real attackers think. They log in as one customer and read another’s data, skip the payment step, or chain three small gaps into a breach. Only a human tester finds those, and those are the findings buyers, auditors and regulators care about most.
Your free report
The quick health check
- Exposed services, forgotten subdomains and encryption gaps
- Missing website protections such as a Content Security Policy
- Risky permissions and secrets in your mobile app
- Ready in about five minutes, completely free
Sumrite expert-led testing
The proof that wins enterprise trust
- Business logic, access control and data isolation tested by hand
- Every finding verified, with evidence and a clear fix
- Report in 48 hours for a scoped web app or API, retest included
- Compliance handled end to end, from SOC 2 and ISO 27001 to PCI DSS and PDPL, with audits through our partner firms
Why Sumrite
The team 250+ companies trust to get through their audits.
Sumrite is a managed cybersecurity and compliance partner. We test your systems, fix the gaps with you and run the whole compliance engagement, so you deal with one team from first scan to final report.
250+Clients cleared through audits
48hExpert report for a scoped web app
23Compliance frameworks covered
NDAFirst, then a fixed quote
At a glance
Sumrite’s free security scan, in brief.
A free online vulnerability scanner for websites and Android and iOS apps from Sumrite, an expert-led penetration testing and compliance firm founded in 2007 and based in New Delhi, serving clients worldwide.
- What it is
- Free website vulnerability scanner and mobile app security scan
- Cost
- Free. No credit card, no sales call
- Time
- Report in about 5 minutes, on screen, as a PDF and by email
- Website checks
- Security headers and CSP, SSL/TLS, open ports, subdomains, DNS security (AXFR, DNSSEC, SPF, DMARC, dangling CNAMEs), exposed APIs and GraphQL, OWASP ZAP passive checks
- App checks
- Android .apk and iOS .ipa: permissions, hard-coded secrets, network security, cryptography, exported components
- Safety
- Passive and safe for live systems: no exploit payloads
- Who can scan
- Owners of the website or app, confirmed by a work email on the same domain
- Provider
- Sumrite (Summit Printrite Private Limited), E-211 FFC, III, Okhla Industrial Estate, New Delhi 110020, India
- Expert testing
- Penetration testing (VAPT) · [email protected]
FAQ
Free vulnerability scan: your questions answered.
Is the Sumrite security scan really free?
Yes. The automated report that many security firms charge for is free from Sumrite. There is no credit card and no sales call needed to get it.
What is a website vulnerability scanner?
A vulnerability scanner is a tool that checks a website, server or app for known security weaknesses: missing protections, weak encryption, exposed services and misconfigurations. Sumrite's free scanner runs those checks from the outside, the way an attacker first looks at you, and turns the results into a plain-language report with risk ratings and fixes.
How quickly will I get my report?
Most reports are ready in about five minutes. Website reports are also sent to the work email you enter, so you can share them with your team, and you can download the full report as a PDF.
What does the free report check?
For websites: security headers such as Content Security Policy and HSTS, SSL/TLS certificates and protocol versions, open ports and exposed services, subdomains, DNS security (zone transfer, DNSSEC, SPF, DMARC, dangling records), exposed API documentation and GraphQL endpoints, and public internet exposure. For apps: risky permissions, hard-coded secrets, insecure network settings, weak cryptography and exported components.
Can I scan a mobile app?
Yes. Upload your Android (.apk) or iOS (.ipa) build in the same box and Sumrite checks it for risky permissions, weak data protection, hard-coded secrets and insecure connections.
Is the scan safe to run on a live website?
Yes. The website scan reads your public pages, DNS and certificates the way a visitor or search engine would, plus a standard check of which ports answer. It sends no exploit payloads and does not try to break in, so it will not take your site down or change your data.
Is the free scan the same as a penetration test?
No. Automated checks find the common, visible issues. A penetration test is led by a security expert who thinks like an attacker, abusing business logic, access control and chained weaknesses that no tool can find. Sumrite offers both.
Does the free scan help with SOC 2, ISO 27001 or PCI DSS?
It is a fast way to clean up the visible gaps before an audit. For the evidence auditors and enterprise buyers ask for, Sumrite's expert-led VAPT gives you a verified report mapped to SOC 2, ISO 27001, PCI DSS, PDPL and DPDP, and Sumrite runs the whole compliance engagement with its partner audit firms.
What should I do with the findings?
Start with the critical and high risks; each finding in the report explains the issue and how to fix it. Then run the scan again to confirm the fix. If you want an expert to verify the results, find what tools miss and retest your fixes, Sumrite's team can take it from there.
Who can I scan?
Websites and apps that belong to your organisation. Use your work email on the same domain as the website so we can confirm it is yours.
Target—
0%