Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/webhood-io/webhood/llms.txt

Use this file to discover all available pages before exploring further.

Webhood is a self-hosted URL scanner that gives threat hunters and security analysts a private, controllable environment for investigating phishing pages and malicious websites. Deploy it on your own infrastructure — AWS, Azure, Google Cloud, or bare metal — and keep all scan data under your control.

Quickstart

Deploy Webhood with Docker Compose and run your first scan in minutes.

Architecture

Understand how Webhood’s four-service stack fits together.

Configuration

Configure environment variables, scanner settings, and TLS.

API Reference

Automate scans and retrieve results via the REST API.

What Webhood Does

When you submit a URL, Webhood’s headless Chrome scanner visits the page and captures:
  • Screenshot — a full-page PNG of what the browser rendered
  • HTML source — the DOM as delivered to the browser
  • Network trace — every HTTP request and response, including headers, status codes, redirect chains, and TLS details
  • Scan metadata — final URL after redirects, timing, initiating user, and scanner configuration
All artifacts are stored in your private PocketBase instance. Nothing leaves your infrastructure unless you explicitly connect to Webhood Cloud.

Key Features

Full Data Ownership

All scan data stays on your infrastructure. No third-party services receive your URLs by default.

Evasion-Resistant Scanning

Stealth mode, cookie-prompt bypass, and configurable browser fingerprinting help expose phishing pages that detect bots.

Advanced Search

Search scans using the PocketBase filter syntax with autocomplete. Share queries via URL.

REST API

Integrate Webhood into your SOC workflows with the authenticated REST API and API token support.

Multi-Scanner Support

Run multiple scanner instances with independent configurations, including simultaneous scan limits.

Cloud Captcha Solver

Optionally connect to Webhood Cloud to bypass CAPTCHAs on heavily protected phishing pages.

Get Started

1

Deploy with Docker Compose

Pull the pre-built images and start all four services — proxy, scanner, UI, and backend — with a single command.
2

Create your first scanner

Use the Settings UI to create a scanner instance and generate its API token.
3

Submit a URL

Enter a suspicious URL in the web UI or call POST /api/v1/scans to start a scan.
4

Analyze results

View the screenshot, inspect the network trace, and review HTML source to determine whether the site is malicious.
Webhood is currently in Public Beta. It is stable for most use cases, but breaking changes may still occur before General Availability. Watch the GitHub repository to be notified of major updates.

Build docs developers (and LLMs) love