The Website tab scans a live website with OWASP ZAP, the widely used open-source web application scanner.
Light scan (every plan)
The light scan crawls the site like a visitor's browser and runs passive checks on every response. It looks at:
- security headers (Content-Security-Policy, HSTS, X-Frame-Options and more)
- cookie flags (Secure, HttpOnly, SameSite)
- information leaks: server banners, error messages, comments, private IP addresses
- outdated JavaScript libraries and mixed content
No attack payloads are sent, so a light scan is safe for any public website. It usually takes one to five minutes.
Full scan (Pro, verified domains only)
The full scan adds ZAP's active scan. It sends real attack payloads to look for SQL injection, cross-site scripting, path traversal, command injection, server-side include, remote file inclusion and more. Because that is only legitimate on systems you are responsible for, a full scan requires:
- a Pro plan, and
- proof that you control the domain (see Verifying domain ownership).
A full scan can take up to about 90 minutes and may create test entries, for example in contact forms. Run it against a staging system if you can.
How the scan is isolated
ZAP runs in a container on a sealed network. Its only way out is an egress proxy that reaches exactly the domain you entered: the address is checked to be public, then pinned for the whole scan, and every request to another host is blocked and listed in the report. Internal networks and the HEIMDALL platform itself can never be reached.
Reading the results
Each alert explains what it means and how to fix it, shows where it was found (method, address, parameter and evidence), and links CWE references. Review the evidence before acting: automated scanners report false positives.