Nikto review
A focused, configurable scanner for local web server security checks.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Nikto is an open-source web server scanner for security professionals and system administrators. It examines web servers for potentially dangerous files and programs, outdated components, configuration issues, insecure software, and other possible vulnerabilities. The tool can identify installed web servers and software, supports host authentication, and runs locally through Perl or Docker. Windows, Linux, and self-hosted deployments are supported, making Nikto a fit for teams that want command-line scanning under their own control rather than a hosted service.
Its strongest area is configurable web server assessment. Plugin-based scanning and updateable scan databases support checks that can be tuned by category, including XSS, SQL injection, file upload, and command execution. Nikto also supports SSL, proxies, attack-encoding options, and server and software identification. Results can be exported to CSV, JSON, HTML, SQL, text, and XML, which gives security teams several ways to retain or process findings. Docker image and Dockerfile deployment add another deployment option for environments that already use containers.
Nikto is a narrower choice than a vulnerability platform built for continuous monitoring across broader infrastructure. Its supported targets are web servers and host URLs, and it does not provide continuous scanning or integrations. That makes it suitable for targeted, locally managed web server checks, configuration review, and repeatable scans tuned to specific categories. Teams seeking an open-source scanner with authentication and flexible reporting should consider it; teams needing ongoing coverage, connected workflows, or a wider range of targets should choose a broader alternative. Nikto is distributed as GPL free software, while its database files have separate licensing terms.
Nikto pros and cons
- Where it wins
- Plugin-based checks with updateable scan databases
- Authentication, SSL, proxy support, and scan tuning
- Exports reports to CSV, JSON, HTML, SQL, text, and XML
- Where it doesn't
- Focused on web servers and host URLs
- No continuous scanning or integrations
- Database files have separate licensing terms
Nikto fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update