Every score, proven.
Scan any website for security posture, quantum readiness, GEO visibility, and AI signals. Every finding shows its raw evidence — graded to CVSS 3.1, mapped to CWE & OWASP. No black-box scores, ever.
Paste a URL above and hit Scan →
Full Scan · Instant mode — results in ~5 seconds
What we scan
Every signal, fully transparent
Eight independent modules. Each returns its own score, raw evidence, and fix recommendations.
Security Assessment
TLS & cipher grade, security headers, DNS/email posture (SPF, DKIM, DMARC, DNSSEC), cookies, and exposure — every finding scored to CVSS 3.1, CWE, and OWASP.
CVE Intelligence
Detected components are matched against a curated knowledge base and the live OSV feed — real CVE ids, CVSS, and the version that fixes them.
Active Testing
On domains you verify: authorized, non-destructive probes for reflected XSS, SQL injection, path traversal, open redirect, and out-of-band SSRF.
AI Detection
Perplexity, entropy, burstiness, lexical diversity, and phrase signals — transparent, per-signal scoring, not a single opaque number.
Quantum Readiness
Post-quantum cryptography posture checked against NIST PQC migration requirements.
GEO Visibility
AI search citation readiness: structured data, Open Graph, and canonical signals scored for ChatGPT and Perplexity.
Who uses it
Built for teams that need real evidence
Brand Safety Teams
Verify advertiser landing pages for AI-generated content, flagged phrases, and schema completeness before campaign spend.
Security Engineers
TLS, header, DNS, and CVE audit with CVSS-graded findings mapped to CWE and OWASP — plus authorized active testing on domains you verify.
SEO & GEO Teams
Score structured data coverage, llms.txt adoption, and AI crawler access across competitor and client domains.
Developers & APIs
POST /api/v1/scans/url. Structured JSON with module scores, checks, signals, evidence strings, and recommendations.
How it works
Scan in three steps
Enter a URL
Paste any public URL. We handle SSRF safety checks automatically before touching the target.
Choose depth
Instant for quick public evidence or Deep for multi-page scanning and fuller reporting.
Get your report
Structured JSON or interactive report with module scores, raw evidence, and fix recommendations.
Post-quantum readiness
Is your site quantum-ready?
NIST's post-quantum standards (FIPS 203/204/205) are final and migration timelines are ticking. AIClicks grades your TLS key exchange, certificate algorithms, and DNSSEC posture — and tells you exactly what to change, with copy-paste remediation.
Key-exchange grading
Classical X25519 vs hybrid PQC groups, negotiated per handshake.
Harvest-now-decrypt-later risk
Whether today's captured traffic could be decrypted later.
Certificate inventory
Classical vs PQC-ready signature algorithms across your chain.
Copy-paste fixes
nginx, Apache, and Cloudflare snippets for PQC key exchange.
Why teams scan with AIClicks
70+
checks per full scan
8
intelligence modules
CVSS 3.1
every finding graded
0
black-box scores
Don't take our word for it — inspect a real sample report.
Start scanning for free — no credit card required
5 free scans a day with an account. Pro at $10/mo, active testing on Advanced at $25/mo. Results in seconds.
FAQ
Common questions
TLS and cipher configuration, certificate validation, HTTP security headers, DNS and email posture (SPF, DKIM, DMARC, DNSSEC, CAA), cookie hygiene, sensitive-file exposure, subdomain-takeover risk, and known CVEs in detected components. Every finding is scored to CVSS 3.1 and mapped to CWE and OWASP Top 10.
On domains you have verified you own, AIClicks runs authorized, non-destructive tests for reflected XSS, SQL injection, path traversal, open redirect, and out-of-band SSRF. It is available on the Advanced plan and never runs on a domain you haven't verified.
No. Every finding shows its raw evidence, the CVSS 3.1 vector it was scored from, the CWE and OWASP references, and remediation steps — so you or an auditor can verify it independently.
Text perplexity via bigram KL-divergence against an English frequency model, Shannon entropy, sentence burstiness, lexical diversity, em-dash density, known AI marketing phrases, and Flesch-Kincaid grade level — each reported individually, not as one opaque number. It is probabilistic evidence, not legal proof.
Yes. POST /api/v1/scans/url with a URL and mode (instant or deep) returns a structured JSON report with modules, checks, findings, signals, evidence, and recommendations. Bulk API access is part of the Enterprise plan.