A free external scan is the fastest way to see what a public website exposes to the internet. It is not a penetration test, internal audit or full PQC assessment. This guide explains what the scan can prove, what it cannot see and what to do next.
The limits are real, but so is the value. Public endpoints are easy for attackers, customers and auditors to inspect. If TLS, certificates, headers or redirects are weak on the outside, those issues are visible before anyone logs in.
NCSC guidance describes automated vulnerability scanning as a cost-effective way to find common issues inside a wider vulnerability management programme. That is the right model: use the scan to find visible issues quickly, then feed the result into ownership, remediation and deeper assessment.
For post-quantum migration, an external scan is a starting signal. It can show whether the endpoint has the TLS 1.3 foundation and whether active hybrid key exchange is visible. It cannot map every cryptographic dependency behind the service.
Move beyond a free external scan when the system handles regulated data, payment data, patient data, financial data, authentication, partner APIs, admin functions or long-lived confidential information.
At that point, you need authenticated testing, internal endpoint discovery, supplier questions, key-management review, signing-workflow review and a cryptographic inventory. OWASP's Web Security Testing Guide is a useful reference for the breadth of manual and application-level testing that automated public scans cannot replace.
No. A free external scanner can check visible public signals for one endpoint. It cannot prove internal security, source code quality, supplier risk, compliance or full post-quantum readiness.
External scans are fast, repeatable and useful for finding visible misconfigurations. NCSC guidance positions automated scanning as a cost-effective way to find common issues within a wider vulnerability management programme.
It can identify externally visible readiness signals such as TLS posture and observed hybrid key exchange where available. It cannot inspect internal cryptography, signing systems or stored-data encryption.
Treat a clean scan as one evidence item. Continue with a full endpoint inventory, supplier review, internal cryptography discovery and periodic rescans.
Use the free scan to capture visible evidence, then turn the result into remediation, inventory and periodic monitoring.
A PQC guide is more useful when it is attached to current evidence. Create a free account, add a public domain now or later, and keep a repeatable baseline for TLS, security headers and visible post-quantum readiness.
Prefer to scan first? Open the free quantum security scanner.