Troja vs. OffURL: which website security scanner wins?

Short version: OffURL is a no-signup public scanner whose current site describes 150+ checks across security, SEO, performance and accessibility. Troja adds AEO, connected-provider analysis, monitoring and an editor-oriented fix loop. OffURL suits a self-contained public report; Troja suits an ongoing public-plus-connected workflow.

What is OffURL?

As reviewed on July 18, 2026, OffURL publishes 150+ checks and a report-by-report workflow with no account required. Its official page describes security, performance, basic search and accessibility signals, while also documenting important limits: it reads raw HTML without JavaScript rendering, does not authenticate, may send active requests that trigger firewalls, and recommends manual verification. Check the live purchase flow for current commercial terms.

Troja vs. OffURL at a glance

Where OffURL is strong

OffURL's security-heavy public report includes categories such as CVE context, threat intelligence, domain and email-authentication signals. The no-account, report-by-report model is useful for an occasional pre-launch check. Its documented raw-HTML and unauthenticated boundary should remain visible beside the result.

Where Troja goes further

Troja covers jobs OffURL's reviewed page does not advertise: AEO, connected-provider context and an ongoing editor/monitoring workflow. OffURL's raw-HTML public scan can still provide valuable external evidence. Choose based on whether the deliverable is one public report or a connected fix-and-retest queue.

Which should you choose?

• You want a self-contained, no-account public assessment → OffURL.
• You also need AI-visibility, your real backend scanned, and an ongoing fix-and-monitor loop → Troja.

Both can fit a layered process: OffURL for a bounded public observation, Troja where security, search, AI visibility and connected remediation share one queue.

OffURL's documented limits are part of the buying decision

OffURL is unusually explicit about its operating boundary. Its official page says the scanner analyzes raw HTML without JavaScript rendering, does not authenticate, and may make active requests that trigger a firewall. It also advises manual verification. Those are not defects hidden in fine print; they define an efficient public-surface scanner whose result must be interpreted in context.

Raw-HTML analysis is valuable for headers, server-rendered metadata, email authentication, exposed resources and other response-level signals. It will not see content that appears only after hydration, nor can it prove the permissions inside a logged-in account. Active requests can provide stronger evidence than passive inspection, but only scan systems you own or have permission to test and watch rate limits and WAF alerts.

A reproducible OffURL-versus-Troja trial

Use a staging host with production-like headers and a harmless seeded account. Before scanning, record which pages require JavaScript or authentication. Then:

1. capture the raw HTML and response headers for the target URL;
2. run both public scans and match findings to the same response evidence;
3. separate passive observations from requests that changed method, path or payload;
4. connect only the minimum repository or provider permissions needed for the deeper pass;
5. fix one issue from each category and compare the retest trail;
6. manually test object ownership and workflow abuse, which neither public result settles.

Choose OffURL when you want a no-account, report-by-report public assessment and its security-heavy categories match the job. Choose Troja when answer visibility, connected providers, recurring monitoring or per-finding editor remediation are core requirements. The current OffURL site describes a first premium report at no charge followed by paid reports, but this comparison deliberately avoids embedding a numeric price: the live checkout is the authoritative source.

For compliance or client work, archive the final HTML response and report checksum with the scan date. Because OffURL does not render JavaScript, state that boundary in the executive summary and attach a separate rendered-browser or authenticated test where application behavior depends on hydration. That makes the limitation actionable instead of hiding it behind a single health score.

If client-side rendering is a concern, work through how to check what ChatGPT can see. For a layered tool strategy, compare Troja, ZAP, Snyk and Burp.