Scan a Public Website
The free scan checks externally visible TLS, security headers and post-quantum readiness signals. The result can be saved to a free account after the scan.
TLS 1.3 Readiness
Checks whether the public endpoint is ready for modern TLS and future hybrid PQC key exchange.
Post-Quantum Exposure
Identifies classical key exchange posture and harvest-now-decrypt-later risk for long-lived data.
Security Headers
Reviews HSTS, CSP, clickjacking protection and other browser security controls.
AI Resilience Signals
Highlights weak patterns that automated attack chains can use as low-friction entry points.
How to Verify a Website's Post-Quantum Readiness
Verification starts with evidence from the live endpoint. Use the scan to separate a modern TLS baseline from active hybrid post-quantum protection, then carry the result into your wider cryptographic inventory.
- 01
Enter the public website domain
Submit the hostname you want to verify. The scanner checks the public HTTPS endpoint without needing an account.
- 02
Review the transport baseline
Check the result for TLS 1.3 support, legacy protocol exposure and browser security headers.
- 03
Check post-quantum key exchange
Look for an active hybrid key exchange such as X25519MLKEM768, not only general TLS readiness.
- 04
Turn the result into an action plan
Save the evidence, prioritise exposed systems and use a cryptographic inventory to plan the wider migration.
For the organisation-wide process, use the post-quantum cryptography implementation guide to move from public evidence to inventory, prioritisation, testing and rollout.
What a Free Scan Result Looks Like
A useful free result should be specific enough to act on. The scanner gives a score, pass/warning/fail checks and a short explanation of the next security steps before asking for an email.
For users who want a record, the post-scan form emails the result and opens the free account flow with the email already filled in.
Example domain
example.com
Modern transport is available.
No hybrid ML-KEM signal detected on the public endpoint.
Strict Transport Security is present.
CSP is missing or too permissive.
What the Free Scan Can and Cannot Prove
The free scan is designed for the first question most teams ask: is the public website ready for the post-quantum transition, or are there basic transport-security gaps that should be fixed first?
It is not a penetration test and it does not inspect internal systems, databases, signing keys or private APIs. Those require a cryptographic inventory and migration plan. For many organisations, however, the public TLS endpoint is the fastest way to find visible quantum-readiness gaps.
If the scanner finds weak TLS, missing security headers or no post-quantum key exchange, the next step is to prioritise systems that carry long-lived sensitive data, then plan a staged migration to NIST-standardised algorithms.
Scanner FAQ
Is the quantum security scanner really free?
Yes. The basic scan is free and checks public website security signals including TLS posture, security headers and post-quantum readiness indicators.
Does the scanner prove my website is quantum-safe?
No automated external scan can prove a full organisation is quantum-safe. It checks externally visible readiness and flags the next steps for TLS, certificates and migration planning.
What is the difference between TLS readiness and active PQC?
TLS readiness means the endpoint can support modern transport security. Active PQC means the server negotiates a post-quantum or hybrid key exchange such as X25519MLKEM768.