OnScanner scans sites for OWASP Top 10, TLS, trackers and consent, with evidence for each finding. Free plan; paid plans from $129/month.
Researched and fact-checked by Bartu Cavusoglu · Updated October 26, 2026
OnScanner is a web security and privacy scanner built by Byte Optimizer. It checks a domain you own or are authorized to test for vulnerabilities, OWASP Top 10 issues, TLS problems, email authentication, trackers, consent behavior and Global Privacy Control handling, then reports each result with the evidence behind it.
Its central claim is findings you can prove. Each finding shows what was observed, where, and what was expected, so a reader can verify it. Results are live and never cached, and they arrive as a structured report, a JSON API response or a PDF.
You point OnScanner at a domain and it runs specialist engines in parallel, signed out or behind your login. Most scans finish in minutes. You choose a scan type (security, privacy or full) and a depth: Quick, Advanced or Deep, with options such as exploit verification and subdomain discovery.
The engines are deterministic, and the company says no model decides whether a finding exists. Confirmed and tentative findings are labeled apart, and a tentative one can never fail a control. When a check cannot prove a finding, it says so. Exploit checks are in-band and non-destructive.
The security engine covers OWASP Top 10 and API checks, CVEs on your detected stack with EPSS and KEV context, protocols from SSLv3 to TLS 1.3, SPF, DKIM and DMARC, product and version fingerprinting with end-of-life flags, open ports, exposed files, WAF detection and optional subdomain discovery.
The privacy engine uses a real browser to record trackers, pixels, fingerprinting and cookies across 40+ categories. It clicks Reject all and Accept all, sends the Global Privacy Control signal, reads Google Consent Mode pings, and flags third parties your privacy policy does not name. Optional AI Findings adds a summary and attack chains.
OnScanner is a security and privacy scanner built by Byte Optimizer. It checks domains for OWASP Top 10 issues, CVEs, TLS, email authentication, trackers, consent and Global Privacy Control, and shows the evidence for each finding.
The Free plan costs $0, Pro is $129/month and Business is $349/month. Enterprise is custom. Yearly billing is $1,290 for Pro and $3,490 for Business, two months free. A security or privacy scan costs 1 credit and a full scan costs 2.
Yes. The Free plan gives 5 scan credits at signup, then tops up to 2 credits every 30 days. Extra credits cost $12 each. The site states no credit card is needed to start.
It offers a REST API and an MCP server. Claude, Cursor or any MCP client can start scans and read findings with an API key. The sources name no other third-party integrations.
No. The company states the scan engines never call an LLM and no model decides whether a finding exists. The optional AI Findings layer only writes summaries, attack chains and prioritization from recorded results.
No. It provides evidence mapped to controls in seven frameworks, such as SOC 2, ISO 27001 and GDPR. It is not a certification, audit or legal advice, and an external scan covers 25 of 229 controls.
Yes. It clicks Reject all and Accept all in a real browser, compares the trackers and cookies loaded, and sends the Global Privacy Control signal. A separate one-off Consent Verification Report costs $199 per domain.
It can suit small teams, since the Free plan lets you run a first scan and credits are paid per scan. Monitoring and team seats start on Pro at $129/month, which may be sizable for very small budgets.