Free vs Pro Scan: What's the Difference?

Quick answer: Free and Pro URL scans grade the same 8 dimensions. Free reports show selected security findings and speed results, while Pro unlocks additional finding details and remediation. Both have coverage limits. Pro Monitoring separately adds scan credits, scheduled rescans, and uptime features; it is not a complete security audit.

By Daniel A · Kraftwire Software

SimplyScan’s free report shows findings in its secrets, frontend, Supabase, and speed categories. Available fix details are retained for the displayed security findings in those categories; speed retains the selected highest-impact fix.

A Pro report unlocks details and available remediation for findings in the other categories. It does not turn an anonymous URL scan into an authenticated audit of your backend.

Choose based on the findings and report details you need. Pro Monitoring is a separate service with scan credits and monitoring features; purchasing a Pro report alone does not provide continuous monitoring.

What Does SimplyScan Check for Free?

A free URL scan typically takes about 30 seconds and requires no signup or source-repository access. It examines selected public-facing resources and signals. Review what ran, what was skipped, and the evidence behind each finding.

1. Secrets Detection

The engine checks supported credential patterns in inspected public resources, including formats associated with AI services, Stripe, cloud providers, and credential-bearing database URLs. Treat pattern matches as findings to investigate; the scan does not prove that every matching value is active or find every secret.

2. Frontend and Header Signals

Frontend findings and security-header findings are classified separately. Pro unlocks details for findings in locked categories; the free security headers tool offers a focused response-header check. Review CSP, HSTS, and frame restrictions in their actual browser context. Inspect session-cookie HttpOnly, Secure, and SameSite attributes separately where applicable; none is a complete defense against every browser attack.

3. Observable Backend Exposure

Supported Supabase checks use discoverable configuration and bounded anonymous probes. Public project identifiers are not secrets, and visible metadata alone is not proof of a data leak. Review RLS, grants, request roles, and authenticated access separately. Service-role credentials belong on a trusted backend because their role can bypass RLS.

What Does the Pro Scan Cover?

Pro unlocks full finding details across the same 8 dimensions, including SEO and accessibility signals. URL scans remain limited to the resources and operations they inspect. Read the coverage record before interpreting a category with no reported findings as tested.

4. Authentication and Authorization Boundaries

An anonymous URL scan does not log in as different users, prove ownership enforcement, or verify every session, recovery, and logout path. The separate owner-run backend audit uses configured test accounts and controlled tests on verified domains. Review the auth flow and test application-specific behavior directly.

5. Injection and CSRF Findings

The engine can report supported patterns in inspected client resources, including risky flows to eval(). Such evidence is not a complete review of server queries or interpreter use. Test backend input handling and CSRF defenses for state-changing operations separately; CORS does not replace authorization or CSRF protection.

6. AI-Service and AEO Signals

The engine checks supported exposed AI-service secrets and selected client-code patterns. It does not establish that a model resists prompt injection or that billable endpoints enforce abuse limits. AEO checks cover observable discoverability and crawler-access signals; they are separate from LLM security testing.

7. Performance Signals

The report includes supported timing, resource, and caching findings. Field Core Web Vitals can be included when CrUX data is available; absent field data is reported as a coverage limitation. Use measurements to prioritize investigation, then test the effect of changes. The scan does not measure your revenue or predict a conversion increase.

8. Dependencies, Domain, Email, and TLS

URL dependency checks recognize supported frontend libraries and versions from inspected resources. They do not read your private node_modules directory or inventory every backend dependency. Other checks inspect domain/DNS signals, selected SPF/DKIM/DMARC properties, and TLS/certificate signals. Record presence and a grade do not establish complete protection.

Using the Performance Findings

Choose a performance finding with relevant evidence and reproduce it in your own environment.

Free reports show speed findings with the selected fix detail; Pro unlocks additional available remediation. This is a report-access distinction, not proof that every bottleneck was measured.

Review AEO and SEO separately from load-time measurements. A faster response does not guarantee ranking, indexing, or citation.

Inspect the resource or request identified in a finding, make a targeted change, and measure again. Check user and business outcomes using your own analytics rather than inferring them from the scan grade.

When Should You Upgrade to Pro?

Use the Free Report To:

• Inspect supported public-facing security and speed findings.
• Investigate possible secret exposure and verify the affected resources.
• Identify where additional tests are needed.
• Use the standalone security headers checker for a focused header review.

Pro Monitoring includes Pro scan credits for full reports. See pricing for the allowance associated with your chosen option.

Consider a Pro Report When:

• You need details and available fixes for locked findings.
• You want a PDF copy of a completed paid report.
• You need to share the observed evidence and coverage with a reviewer.

A users table or sensitive data requires appropriate authorization testing regardless of the report tier. For scheduled rescans, uptime monitoring, and scan credits, assess Pro Monitoring separately. A report is not legal-compliance certification or proof that abuse controls work.

Feature Comparison: Free vs. Pro

Compare report visibility and monitoring features separately from scan coverage.

• Graded Dimensions: Free and Pro grade the same 8 dimensions.
• Selected Security Findings: Free shows secrets, frontend, and Supabase findings with their available fixes; Pro also unlocks findings in other categories.
• Speed: Free shows speed findings and the selected highest-impact fix; Pro unlocks additional available fix details.
• Other Categories: Free retains grades and locked-finding summaries; Pro unlocks their details.
• PDF Reports: Available for completed paid reports.
• Uptime and Scheduled Rescans: Features of Pro Monitoring, separate from a standalone Pro report.
• Free Rescans: The free scan includes 2 rescans, subject to the report’s eligibility rules.
• Coverage: Neither report tier verifies all authenticated or server-only behavior.

How the SimplyScan Security Engine Works

The SimplyScan Security Engine analyzes inspected evidence and records coverage. Both tiers share core checks; a Pro URL scan can inspect a broader bounded set of pages. Neither sees everything an attacker could reach.

Resource Collection

The engine fetches page content and follows selected script resources. Optional bounded browser capture can add runtime observations when available. It does not execute every path or guarantee that all JavaScript was observed.

Analysis

It evaluates supported page, resource, header, and runtime signals. Check the report for skipped or partially tested areas.

Pattern Matching

Deterministic rules identify supported patterns in the inspected evidence. Findings need investigation in the application’s context, and a clean result does not prove absence of vulnerabilities.

Reporting

The report presents category grades, findings, and coverage. Finding visibility and fix-detail access depend on the tier; those display rules do not remove locked findings from the security score.

The MCP server supports URL scanning and a separate Pro tool for selected file contents. For file scanning, source leaves the editor for in-memory analysis; masked findings are saved, and no AI provider receives those files. JavaScript and TypeScript receive code-rule checks, while other files receive secret-pattern checks. It does not scan an entire local environment automatically.

Start Free, Scale with Pro

Use the free report to inspect the findings it exposes, and evaluate an upgrade based on the details you need.

Include application-specific testing and review in launch decisions regardless of the tier.

Runtime varies with the target and available checks; the usual scan duration is an estimate.

A paid report documents observed findings and available remediation. It does not certify that data or reputation is protected.

Use the evidence to plan fixes, retest affected paths, and record remaining coverage gaps.

Run a Free Scan Now · Explore Pro Monitoring

Related Guides

• Vibe Coding Security Checklist
• How to Read Your SimplyScan Report
• Supabase Security Checklist
• AI Visibility and AEO Guide

Pro Monitoring costs $24/month.

Pro report costs $14.99 one-time.