Use case
Scan your running website, passively
Add a URL and OWASP ZAP checks what the live site sends every visitor: headers, cookies, information leaks and mixed content. Read-only page loads, no form posts, no attack payloads, and 10 credits a scan.
passive website scan https://example.com ✓ address ✓ crawl ✓ checks ✓ triage passive: 10 credits. active: planned $
Illustrative readout of how passive scans work, not real scan output.
In short: Passive scanning is available now. OpenRouting runs OWASP ZAP passive analysis over a capped crawl of your site using read-only page loads, then has Claude triage each finding with a verdict, a plain-English explanation and a suggested fix. Active scanning, API scanning and logged-in dashboard scanning are planned, not available yet.
What a passive scan checks
A passive scan looks at what your site already sends to any visitor. It reports what OWASP ZAP's passive rules find in those responses, for example:
- Missing or weak security headers (CSP, HSTS, X-Frame-Options and similar).
- Cookie flags such as Secure, HttpOnly and SameSite.
- Information leaks: server versions, stack traces, internal paths and comments.
- Mixed content: HTTPS pages that load resources over HTTP.
How the scan runs
The scan is OWASP ZAP (Apache-2.0) passive analysis over a capped crawl: depth 3, roughly two minutes. It uses ordinary read-only GET page loads. It does not submit forms and sends no attack payloads. A passive scan costs 10 credits and is refunded if it fails.
Findings are triaged by Claude the same way code findings are: a verdict with a confidence score, a plain-English explanation and a suggested fix. Evidence is redacted (secrets, card numbers, email addresses) and only short snippets are stored.
For a site's latest completed scan you can generate an AI-written security report for 10 credits and download it as PDF or Markdown. It summarises findings by page and theme and states what the passive scan covered and what it did not test: injection, access control, business logic, pages behind a login and APIs beyond the crawl.
What we refuse to scan
Every scan re-resolves your address and refuses private (RFC 1918), loopback, link-local and cloud-metadata addresses, so the scanner cannot be pointed at internal infrastructure. Only http and https URLs without embedded credentials are accepted. The scanner is pinned to the address it checked and runs in an isolated, short-lived container away from our internal services.
What is planned
These are planned and not available yet. We are not giving dates.
- Active scanning with ZAP safe rules, only after you prove you own the domain.
- Live API scanning that sends requests to your API. (Static analysis of API collections is available now.)
- Authenticated scanning of dashboards behind a login.
About our scanner
If you see requests from OpenRouting in your logs, they come from a passive scan someone added your site to. They identify themselves with the User-Agent OpenRouting-Scanner/1.0 (+https://openrouting.si/scanner). They are read-only GET requests, limited to a shallow crawl of a couple of minutes. To opt out or report unwanted scanning, email [email protected].
Common questions
Can I scan any URL?
Passive scanning works on any public website you add by URL. Active scanning is planned and will require proving you own the domain first; it is not available yet.
Does it attack my site?
No. A passive scan only loads pages with ordinary read-only GET requests and inspects the responses. It submits no forms and sends no attack payloads. Active scanning, when it arrives, is planned to use safe rules only and only on verified domains.
Can it scan internal or private addresses?
No. OpenRouting re-checks the address at every scan and refuses private, loopback, link-local and cloud-metadata addresses.
How do I recognise the scanner in my logs?
Requests identify themselves as OpenRouting-Scanner/1.0 (+https://openrouting.si/scanner) in the User-Agent header.
What does a passive scan cost?
10 credits per scan. A scan that fails is refunded automatically.
Is API or logged-in dashboard scanning available?
Not as live scans. Sending requests to an API and scanning dashboards behind a login are planned, and both would sit behind domain verification. Static analysis of API collections (Postman, OpenAPI, Swagger, HAR, Insomnia, Bruno) is available now and sends no traffic to your API.