Free XSS Scanner
Check any website for cross-site scripting indicators
Enter a URL to passively analyze a page for cross-site scripting (XSS) risk indicators. This tool checks for missing CSP headers, inline event handlers, unsafe JavaScript patterns, reflected parameters, and third-party script inclusions — without injecting any payloads.
Trusted by teams at
How it works
How XSS Scanner works
Enter a URL
Paste any URL — ideally one with query parameters so the scanner can check for reflected input. The scanner fetches the page and analyzes its content passively.
Passive XSS analysis
We check for missing Content-Security-Policy headers, inline JavaScript event handlers, unsafe DOM manipulation patterns, reflected URL parameters in the response body, and third-party script inclusions.
Get risk assessment and fixes
Each XSS indicator is explained with its risk level and specific remediation steps — from CSP configuration to input sanitization best practices.
Features
What XSS Scanner checks
Check Content-Security-Policy protection
Verifies whether a CSP header exists and whether it blocks inline script execution. Missing or misconfigured CSP is the primary reason XSS attacks succeed in modern applications.
Detect inline event handlers
Scans HTML for inline event attributes like onclick, onerror, onload, and onmouseover that execute JavaScript directly in the markup — common XSS injection targets.
Find reflected URL parameters
Checks whether query parameter values from the URL appear in the response body, which indicates potential reflected XSS if the output isn't properly encoded.
Identify unsafe JavaScript patterns
Searches for dangerous patterns like document.write, innerHTML assignments, and eval() calls that create DOM-based XSS sinks if they process untrusted input.
Catalog third-party script sources
Lists external script domains loaded by the page. Each third-party script is a potential supply-chain attack vector — if compromised, it can inject malicious code into your site.
Use cases
Who should use the free XSS Scanner
Web Developers
Check your pages for XSS risk indicators before deployment. Identify missing CSP headers, inline handlers that need refactoring, and reflected parameters that need encoding.
Security Engineers
Quickly assess a web application's XSS attack surface during a security review. Prioritize pages with reflected parameters and missing CSP for deeper manual testing.
QA Teams
Include XSS indicator checks in your testing workflow. Catch regressions where new features introduce inline event handlers or remove CSP protections.
More tools
All free security tools
Scanners
(9)Checkers
(7)Decoders & Generators
(3)FAQ
Frequently asked questions
Everything you need to know about the free XSS Scanner.
Go beyond XSS Scanner
This free XSS Scanner checks a handful of things. Maced's AI pentest checks thousands.
Get a full autonomous penetration test — including OWASP Top 10, authentication flaws, business logic errors, API security, and more — with a compliance-ready report in hours.
Proof of exploit on every finding · SOC 2 & ISO 27001 compatible