Header checkers, scanners or a penetration test?
Short answer: a free header checker tells you whether a few HTTP headers are set; an automated website scanner (like HackGrade) checks many outside-visible issues across HTTPS, headers, email records and CMS components and can repeat that on a schedule; a manual penetration test uses a human tester to find logic and access-control flaws that tools miss. Most small businesses should start with a scanner and add a penetration test when the risk or a standard calls for one.
| Header checker | Website security scanner | Penetration test | |
|---|---|---|---|
| What it checks | HTTP response headers of one URL | HTTPS/TLS, headers, cookies, DNS email records, CMS and plugin versions, exposed files; deeper tests with permission | Whatever is in scope, including business logic and logged-in areas |
| Who runs it | You, in a browser | Automated, on demand or scheduled | A human security tester |
| Time | Seconds | Seconds (passive) to minutes (deep) | Days to weeks |
| Fix guidance | Usually brief | Varies by tool; HackGrade gives step-by-step fixes | A written report |
| Repeats | Manual | Continuous monitoring possible | Point in time |
| Cost | Usually free | Free tier to monthly plans | Priced per engagement; varies widely |
When a header checker is enough
When you have just changed server or CDN settings and want to confirm one header is now present. It doesn’t tell you about certificates, email spoofing or outdated software.
When a scanner is the right tool
For most small-business sites: it covers the issues automated attacks actually look for, ranks them, and can run again every week so you notice when a certificate nears expiry or a plugin gets a new vulnerability. HackGrade’s free scan is passive; its deeper tests run only for verified owners who accept the scan authorization agreement.
When you need a penetration test
- You handle sensitive data or large payment volumes, or a contract or standard requires one (for example PCI DSS requirement 11.4).
- You run a custom web application with accounts, roles or complex business rules.
- You want a human to try to chain small issues into a real attack.
What no remote tool sees
None of these replaces updates, backups, two-factor login and good passwords. Remote tools can’t see your server’s files or your hosting account. See the small-business security checklist.
Frequently asked questions
Is HackGrade a penetration test?
No. HackGrade is an automated scanner. Its deep scan runs active tests on verified domains, but it doesn’t replace a human tester for business-logic or contractual pentests.
Can a scanner and a pentest find the same issues?
They overlap on common, visible issues. A scanner is faster and repeatable; a tester finds logic flaws and chains.
Which should I do first?
Run a scanner first and fix what it finds. A penetration test is better value when the easy issues are already gone.