How to Scan Websites for PII Before Launch

Launching a website with exposed personal information is a security disaster waiting to happen. In this guide, we'll walk you through the complete process of scanning your website for PII (Personally Identifiable Information) before you go live. Whether you're in Europe, the US, or anywhere else, this checklist will help you find and fix sensitive data before your users—or regulators—do.

Why Pre-Launch PII Scanning Matters

Data breaches cost companies an average of $4.45 million per incident. But most don't happen because of hackers—they happen because of exposure. Personal information accidentally left in:

• Comment threads or user-generated content
• Error pages that display stack traces or database queries
• Test data that wasn't cleaned up before launch
• Meta tags or hidden fields in HTML
• PDF files or downloadable documents
• Email addresses or phone numbers in contact forms
• Social media feeds or API endpoints

Pre-launch scanning catches these issues before they become public. It's also a key requirement for GDPR compliance, PCI-DSS certification, and HIPAA audits.

Those three names are worth spelling out. Regulation (EU) 2016/679 — the GDPR, applicable across the EU since 25 May 2018 — asks for data protection by design and by default in Article 25(1), which is a duty at build time rather than a clean-up afterwards, and for a data protection impact assessment in Article 35 where the processing is high risk. Article 33(1) leaves 72 hours to notify a breach once you know about it. The fine bands are Article 83(5), up to €20 million or 4% of worldwide annual turnover, and Article 83(4), up to €10 million or 2%. On the payments side, PCI DSS version 4.0 appeared in 2022 and became the only active version when v3.2.1 was retired in March 2024. On the health side, HIPAA dates from 1996, and its Security Rule has been in effect since 2005.

The scan itself has fixed edges, which is useful when you are planning a launch week: one run covers at most 1,000 pages, each call to the detection API takes at most 50,000 characters, and 20 new scans per hour are available from one IP address.

The 5-Step Pre-Launch Scanning Process

Step 1: Create a Comprehensive Content Audit

Before you scan anything, you need to know what you're scanning. Create an inventory of every page, file, and resource on your website:

• Public pages: Home, about, services, blog posts, documentation
• Forms: Contact, registration, checkout, feedback
• Dynamic content: User profiles, comments, forums, uploaded files
• Admin/backend pages: Dashboards, API documentation, testing pages
• Error pages: 404, 500 errors (often show too much info)
• Redirects and staging: Old URLs, staging environments that might be accessible
• Generated files: PDFs, exports, receipts, invoices
• Meta content: Open Graph tags, structured data (JSON-LD)

Step 2: Connect the Detection Engine

piisafe.eu runs on the anonym.legal API: 58 entity types across 48 languages and dedicated identifiers for 14 countries, with plans from EUR 3/month. You supply your own API key, so scan content never has to pass through an account we control.

Detection is reproducible: format identifiers such as IBANs and card numbers are matched exactly, and the NLP recogniser used for names, organisations and locations runs with fixed settings, so the same page scanned twice yields the same findings. That matters for compliance documentation.

Step 3: Select the Right Compliance Preset

PII detection is not one-size-fits-all. Your industry determines what data you need to find:

• GDPR: For EU websites. Focuses on personal data, email addresses, and identifiers.
• HIPAA: For healthcare. Detects medical record numbers, diagnoses, and health information.
• PCI-DSS: For payment processing. Targets credit card numbers, SWIFT codes and cardholder names.
• CCPA: For California-based users. Emphasizes personal identifiers and household information.

If your website serves multiple regions, run scans for each relevant preset. It's better to find a hidden credit card number in testing than have a customer find it on your live site.

Step 4: Run Your First Scan

Now it's time to actually scan. Here's the process:

1. Go to piisafe.eu/scanner.html
2. Enter your website URL
3. Let the scanner discover pages (via sitemap or crawling)
4. Select your compliance preset and configuration
5. Review the cost estimate (token usage)
6. Click "Start Scan"

The scanner will show real-time progress and flag every page with detected entities. You'll see a risk grade (A-F), findings by type and severity, and an exportable report.

Step 5: Remediate Findings and Verify

For every PII detection found, you have several options:

• Remove it: Delete the content entirely if it's not needed
• Mask it: Replace PII with tokens or asterisks (e.g., XXX-XX-1234 for SSNs)
• Restrict access: Move sensitive content behind authentication
• Encrypt it: Use client-side encryption for sensitive fields
• Contextualize it: Add explanations so users understand why data appears

After remediation, run the scan again on the updated pages. You're not done until you get a clean report.

Common PII Findings and How to Fix Them

Test Data Left Behind

Finding: Scan detects SSN "123-45-6789" or credit card "4111-1111-1111-1111"

Fix: These are test numbers used during development. Remove them from all HTML, CSS, and JavaScript. Use random strings instead: "XXX-XX-XXXX"

Email Addresses in Hidden Fields

Finding: Multiple email addresses detected in HTML comments or form action attributes

Fix: Remove all hardcoded email addresses from frontend code. Use form handlers instead. Never put email addresses in HTML comments or JavaScript strings.

Person Names in Documentation

Finding: Tutorial pages mention "John Smith" or "Jane Doe" as examples

Fix: Replace with generic names like "User123" or "Developer", or use placeholder text: [USER_NAME].

Error Pages with Stack Traces

Finding: 500 error page shows database query or file path revealing structure

Fix: Display generic error messages to users. Only log detailed errors server-side where users can't see them.

API Endpoints Leaking User Data

Finding: JSON response includes too many fields (email, phone, address, SSN)

Fix: Implement proper API field filtering. Only return data that users need. Mask sensitive fields. Require authentication.

Post-Launch Maintenance

Scanning before launch is just the beginning. Here's how to stay secure after going live:

• Monthly scans: Run regular scans to catch new issues from content updates
• Before updates: Scan after deploying new features or code changes
• After user incidents: Scan if a user reports seeing unexpected data
• Quarterly audits: Deep-dive scanning using different compliance presets
• Documentation: Keep scan reports for audit trails and compliance proof

The Limits of a Pre-Launch Scan

A pre-launch scan catches one class of problem well. These are its limitations, and the cases where another tool serves you better.

• Only what a crawler can reach. The scanner requests pages over HTTP like any visitor and reads only responses of type text/html. Content behind a login, inside a PDF, or drawn by JavaScript after the page loads stays invisible to it.
• Scan size is capped. One run covers at most 1,000 pages, and each call to the detection API takes at most 50,000 characters, so the scanner splits longer pages into chunks first. A large site needs several runs.
• Detection is a hybrid, not an oracle. Formatted identifiers such as IBANs match on pattern and score 1.0. Names, organisations and locations come from an NLP model and score lower. Both halves produce false positives and false negatives, so a person still has to read the findings.
• It is not a security test. A PII scan says nothing about authentication flaws, injection or broken access control. Article 32 GDPR asks for appropriate technical and organisational measures; a content scan covers one corner of that, not the whole of it.
• It is not continuous monitoring. Scans run on demand, and the rate limit allows 20 new scans per hour from one IP address. If you want a check on every deploy, wire it into the release pipeline instead of running it by hand.

Key Takeaways

Pre-launch PII scanning is not optional—it's a security essential. Here's what you need to remember:

• Create a complete content inventory before scanning
• Use a scanner whose results are reproducible
• Choose the compliance preset matching your industry and users
• Run the scan, identify findings, and remediate
• Verify fixes with a follow-up scan
• Continue scanning after launch on a regular schedule