Nikto
Nikto is a free, open-source web server scanner for security professionals, penetration testers, and system administrators.
What Nikto is
Nikto is a free, open-source web server scanner for security professionals, penetration testers, and system administrators. It checks web servers and host URLs for more than 8,000 potentially dangerous or notable files and programs, as well as outdated server versions and common misconfigurations. The scanner identifies server software using headers, page content, and file analysis, and scan items and plugins can update automatically. Users can tune scans by including or excluding check classes, target multiple ports or servers, and use server lists from Nmap output. Custom checks can be added with CSV files. Reports are available in plain text, JSON, SQL, XML, HTML, and CSV, including direct reporting to MySQL and PostgreSQL. Nikto supports IPv4, IPv6, and HTTP proxies, detects TLS configuration and fingerprints, and handles cookies automatically, with an option to disable cookie use. It supports Basic and NTLM host authentication and can attempt credentials for Basic, NTLM, and Digest authorization realms. Installation options include Perl, Docker, and Windows. The code is GPLv3, while database files are restricted to use with Nikto unless a commercial license is obtained.
Good
- Checks for more than 8,000 potentially dangerous or notable items.
- Offers reports in six formats, including JSON and HTML.
- Supports IPv4, IPv6, and HTTP proxies.
- Scan checks and plugins can update automatically.
Watch out
- Database files are restricted to use with Nikto.
- Commercial database use requires a license.
- The code is GPLv3.
Who it suits
Nikto is suited to security professionals, penetration testers, and system administrators assessing web servers. Its scan controls and multiple report formats may also suit teams with custom checking or reporting needs.
Verdict
Nikto offers configurable web-server scanning, authentication support, and a wide range of report formats. Review the separate database-file terms if your intended use involves commercial licensing or distribution.
Plans and prices
From Nikto's own pricing page, checked 4 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Nikto | Free | Free software under GPLv3 · Database files are restricted to use with Nikto; commercial use requires a license |
The facts
Each one read from Nikto's own pages, with the date it was checked.
What it does
- Authentication
- It supports Basic and NTLM host authentication and can guess credentials for Basic, NTLM, and Digest authorization realms.checked 4 Oct 2026
- Custom checks
- Users can add custom checks through CSV files.checked 4 Oct 2026
- Detection
- It identifies installed web servers and software using headers, content, and file analysis, and its scan items and plugins can update automatically.checked 4 Oct 2026
- False positives
- The scanner uses headers, page content, hashing, and other methods to reduce false positives.checked 4 Oct 2026
- Install options
- The project documents Perl installation, Docker images, and Windows installation.checked 4 Oct 2026
- License terms
- Nikto 2.6 code is GPLv3, while its database files may only be distributed with and used in Nikto unless a commercial license is obtained from the author.checked 4 Oct 2026
- Protocols and proxies
- Nikto supports IPv4, IPv6, and HTTP proxies.checked 4 Oct 2026
- Purpose
- Nikto is an open-source web server scanner for security professionals, penetration testers, and system administrators.checked 4 Oct 2026
- Reporting
- Scans can produce plain text, JSON, SQL, XML, HTML, or CSV reports, including direct reporting to MySQL and PostgreSQL.checked 4 Oct 2026
- Scan controls
- Users can tune scans to include or exclude vulnerability check classes and scan multiple ports or servers, including servers listed in Nmap output.checked 4 Oct 2026
- Scan coverage
- It checks for over 8,000 potentially dangerous or interesting files and programs and identifies outdated server versions and common misconfigurations.checked 4 Oct 2026
- Support
- The project directs users to GitHub or Docker and its documentation for support, and asks users to open GitHub issues for bugs, feature requests, or questions.checked 4 Oct 2026
- TLS and cookies
- Nikto detects TLS configuration and fingerprints, handles cookies automatically, and offers an option to disable cookie use.checked 4 Oct 2026
Alternatives to Nikto
- 1
NSAuditor AI
Free planOpen sourceAPILinuxmacOSSelf-hosted8.0From $470 a year - 2
ManageEngine Vulnerability Manager Plus
Free planWebAPILinuxmacOS7.9From $695 a year - 3
Microsoft Defender for Business
AndroidiOSAPImacOS7.5 - 4
Intruder
Free planWebAPILinuxmacOS7.4Free plan - 5
OpenVAS
Free planWebAPILinuxmacOS7.2From €2,524 a year - 6
Nmap
Free planLinuxmacOSSelf-hostedWindows7.0From $9,980 a month