Cloudflare Opens URL Scanning to Everyone
Gathering technical context on a URL is often the first step in any security investigation, but assembling all the relevant data typically means juggling multiple tools. Cloudflare's Radar URL Scanner, now in free early access at radar.cloudflare.com/scan, aims to consolidate that work into a single report.
Give the scanner a URL and it returns a public report covering phishing detection, SSL certificate details, HTTP transactions, DNS records, cookie attributes, page performance, and the underlying technology stack. The service also follows redirects, so a shortened link will produce a report for its final destination.
What a Report Contains
The scanner organizes its findings into tabs by category. Each one targets a different aspect of the page's behavior and infrastructure.
Security and Privacy Signals
The Security tab checks the URL against phishing datasets and presents certificate information, helping to establish whether a page is safe to visit. The Cookies tab complements this by listing every cookie the page sets and its attributes. Two flags matter most here: Secure, which restricts transmission to HTTPS, and HttpOnly, which blocks JavaScript API access and can reduce the impact of XSS attacks.
Network and Performance Data
The Network tab enumerates every HTTP request and response required to render the page, giving engineers a view of which external hosts the site depends on. It also surfaces the hostname's DNS records. A separate Performance tab draws on the Performance Navigation Timing metrics to break down load time, acknowledging that security alone doesn't make a page usable.
Stack and DOM Details
The Technology tab identifies the frameworks, libraries, and services powering the page, which becomes relevant during service outages or when exploits surface in popular packages. The DOM tab compiles the page's hyperlinks and global JavaScript variables, and also exposes the raw HTML for deeper inspection.
Built on Workers Browser Rendering
All scans run headlessly through Cloudflare's Workers Browser Rendering API, the same underlying technology available to developers through its waitlist. The choice means the scanning infrastructure itself is a Cloudflare product, not a third-party integration.
Roadmap and Feedback
Cloudflare plans to extend the tool with API endpoints to replace GUI dependence, private scans for sensitive or recurring reports, and security recommendations tied to the Cloudflare Security Center. Because the scanner is a Radar product, aggregated scan data will also feed back into Cloudflare's threat modeling and eventually produce industry-wide insights and visualizations.
Until then, the scanner is live and free. Questions, feedback, and enterprise feature wishlists can go to @CloudflareRadar or [email protected].
