Webhood is a free, open-source URL scanner built for threat hunters and security analysts who need full control over their investigation data. Unlike cloud-based scanners that process URLs on shared infrastructure and log your queries, Webhood runs entirely on your own server — whether that is an on-premises machine, an AWS instance, a Google Cloud VM, or any other host you control. Every screenshot, HTML capture, and network trace stays inside your environment, making Webhood the right choice for analyzing sensitive phishing links, internal threat intel, and malicious sites without exposing indicators to third parties.Documentation Index
Fetch the complete documentation index at: https://mintlify.com/webhood-io/webhood/llms.txt
Use this file to discover all available pages before exploring further.
Webhood is currently in Public Beta. It is stable enough for most production use cases, but you may encounter bugs or missing features. Breaking changes will be announced via GitHub releases. Watch the repository to stay notified of major updates.
How Webhood Works
When a user submits a URL, Webhood’s headless-browser scanner visits the page and captures a full-page screenshot, the rendered HTML, and a detailed network trace of every HTTP request and response made during the page load. All artifacts are stored in the PocketBase backend and immediately accessible through the Next.js UI. The Kong API gateway sits in front of all services, handling routing, CORS, and authentication so that only one port needs to be exposed to users. The stack is made up of four cooperating Docker containers:| Service | Container name | Role |
|---|---|---|
| Kong | webhood-proxy | API gateway — routes traffic to core UI or backend, handles auth and CORS |
| Scanner | webhood-scanner | Node.js/TypeScript service that drives headless Chrome via Puppeteer |
| Core UI | webhood-core | Next.js frontend served at the root path |
| Backend | webhood-backend | PocketBase (Go) providing auth, SQLite database, file storage, and REST API |
Key Capabilities
- Screenshot capture — full-page screenshot of the URL as rendered by a real Chromium browser
- HTML capture — the fully rendered DOM saved for offline inspection
- Network trace — complete HTTP request/response metadata including headers, host IPs, and redirect chains
- Advanced search — PocketBase filter syntax with autocomplete to query across all scan fields
- Stealth mode — optional Puppeteer stealth plugin to reduce bot-detection fingerprinting
- Cookie prompt bypass — optional extension to dismiss cookie consent dialogs before capturing
- Configurable scan speed — Fast, Balanced, or Slow presets to handle different page-load behaviors
- Multi-scanner support — connect multiple scanner instances to a single backend
- Private IP blocking — optionally prevent the scanner from visiting internal network addresses
Deployment Options
Webhood ships as a Docker Compose stack and can be deployed anywhere Docker Engine runs:- Self-hosted server — any Linux host with Docker Engine 20+ and Docker Compose v2
- AWS — EC2 instance or container service
- Google Cloud — Compute Engine VM or Cloud Run (with persistent volume for PocketBase data)
- Azure — Virtual Machine or Azure Container Instances
High-Level Workflow
Deploy the stack
Clone the repository, configure your
.env file, and bring up all four services with docker compose up -d. The UI is available on port 8000 by default.Configure a scanner
Open Settings → General in the UI and create a scanner instance. Copy the generated scanner token and set it as
SCANNER_TOKEN in your .env file, then restart the scanner container.Submit a URL
Paste any URL into the scan input on the home page and click Scan. The scanner picks up the job in real time (or within 10 seconds as a fallback) and begins visiting the page.
Explore the Docs
Quickstart
Deploy Webhood with Docker Compose and run your first scan in under 10 minutes.
Architecture
Learn how Kong, the scanner, the core UI, and PocketBase fit together.
Environment Variables
Full reference for every
.env variable that controls Webhood’s behavior.API Reference
Integrate Webhood into your automation workflows using the REST API.