Is Nuclei safe to run against a production website?

With the right tags, yes; with the full template set, not reliably. The categories that cause trouble are denial-of-service, intrusive and fuzzing templates, which can exhaust resources, write data or hammer a login endpoint — exclude them explicitly with -exclude-tags dos,intrusive,fuzz,fuzzing,brute-force rather than assuming the defaults are gentle. Also cap the request rate (-rate-limit 50 is calm for a small site) so you do not trip your own WAF or rate limiter and end up scanning an error page. Run it first against staging if you have one, tell whoever watches your monitoring that you are doing it, and only ever point it at systems you own or have written authorisation to test.

What are Nuclei templates and which tags should I use?

A template is a YAML file describing a request and the response pattern that proves a condition — the community repository holds thousands, updated daily, which is where the scanner's value lives. Tags group them by category. For a normal website the high-signal set is misconfig, exposure, cve, default-login, takeover and panel: server misconfigurations, exposed files and endpoints, known vulnerabilities, default credentials on admin software, subdomain-takeover conditions and publicly reachable login panels. Everything else is either noise on a typical site or belongs in the excluded list. Keep templates updated with nuclei -update-templates, and remember that a template only exists for a problem someone has already written up.

Is Nuclei enough on its own?

It is enough for one specific job: finding problems the internet already has a signature for. It will not find broken access control between two of your users' accounts, a business-logic flaw in your checkout, or an authorisation check missing on a single endpoint, because no template can know your data model. It also only scans the targets you hand it, so it misses assets nobody remembered — the forgotten staging host is a discovery problem, not a scanning one. A practical stack is passive configuration checks first, subdomain discovery to build the target list, Nuclei for the known-problem sweep, and a human for anything involving authorisation or logic.

Nuclei or a commercial vulnerability scanner?

Largely the same ground, different packaging. Commercial scanners such as Intruder, Detectify or HostedScan wrap comparable engines and add crawling, scheduling, ticket integration, reporting and someone to call, typically for €100–600 a month priced per target. Nuclei costs nothing but needs a person who will run it on a schedule, keep templates current, triage false positives and decide what matters. Choose the paid product when the operational layer is worth more to you than the licence fee, or when a customer or auditor wants a vendor name on a report. If it is just you and a handful of sites, the open-source tool plus a documented routine is genuinely sufficient.

Nuclei Vulnerability Scanner — Safe Tags and Real Limits

Nuclei is an open-source scanner that checks a target against thousands of community-written YAML templates — one template per known misconfiguration, exposed panel or CVE. It is fast, free and genuinely useful, and it will happily send traffic you did not intend, so the tags you choose matter more than the install.

What is the Nuclei vulnerability scanner?

Nuclei, from ProjectDiscovery, is a request-and-match engine. A template describes an HTTP request (or DNS, TCP, SSL, file or JavaScript check) and the response pattern that proves a condition — a status code, a string in the body, a header, a regex. The binary runs the templates you select against the targets you give it, in parallel, and prints matches. That is the whole model, and it is why the project moves quickly: a new CVE becomes a pull request against the template repository, not a release of the scanner itself (docs).

The consequence people miss: Nuclei finds what someone has already written a template for. It is an excellent detector of known, public, patterned problems and a poor detector of anything specific to your application — broken access control between two of your accounts, a business-logic flaw, an authorisation check missing on one endpoint. Those need a different kind of testing.

How do you install and run it safely the first time?

# Install (Go 1.21+), or grab a release binary from the repo
go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
nuclei -update-templates

# A conservative first run against a host you own
nuclei -u https://example.com \
  -tags misconfig,exposure,cve,default-login,takeover,panel \
  -exclude-tags dos,intrusive,fuzz,fuzzing,brute-force \
  -rate-limit 50 -timeout 10 -silent -jsonl -o nuclei.jsonl

That command is not a generic example — it is, flag for flag, what our engine runs inside a full audit. The reasoning behind each part is the useful bit:

-tags misconfig,exposure,cve,default-login,takeover,panel — the categories that are high-signal on a normal website: server misconfigurations, exposed files and endpoints, known CVEs, default credentials on admin software, subdomain takeover conditions, and login panels that should not be public.
-exclude-tags dos,intrusive,fuzz,fuzzing,brute-force — the categories that can take a site down, write data, or hammer a login. Running the full template set against production without this is how people discover that a scanner can cause an outage. Exclusion is not optional in our book.
-rate-limit 50 — requests per second. The default is higher; 50 keeps a small site and its WAF calm.
-jsonl — one JSON object per finding, which is what you want if anything downstream reads the output.

Common gotcha: nuclei will duplicate whatever passive checking you already do. Run it after a headers/TLS/DNS check and you will see the same missing security header reported twice, once by each tool, which trains people to skim results. Our integration drops template IDs that match checks we already perform passively — missing-security-headers, tech-detect, tls-version, cookie-*, dmarc and friends — so nuclei only adds what the passive pass could not see. If you assemble your own pipeline, build the same suppression list or you will drown in your own echo.

What does Nuclei not find?

Anything unique to your app — IDOR and broken access control between two real accounts, privilege escalation, logic flaws in a checkout or a quota. No template knows your data model; detecting those takes two accounts and a comparison, which is what API security tooling is for.
Things behind authentication, unless you configure credentials and accept the risk of a scanner acting as a logged-in user.
Assets you did not give it. Nuclei scans the targets you pass. Finding the forgotten staging host is a different job — see subdomain enumeration.
Context. It reports that a panel exists; it does not know whether that panel is your intranet behind an IP allow-list or a genuine hole. Somebody has to decide.

Nuclei vs a vulnerability scanner vs a pentest

Approach	Finds	Misses	Cost
Nuclei (you run it)	Known CVEs, exposed panels and files, default credentials, misconfigurations	App-specific logic, authorisation bugs, unknown assets	Free + your time and judgement
Commercial scanner	Similar ground, plus crawling, scheduling, ticket integration and a support line	Same blind spots; usually priced per target	€100–600/month
Manual pentest	Logic flaws, chained attacks, authorisation bugs — the things templates cannot encode	Nothing structural; it is a point-in-time engagement	€3,000–10,000+

They stack rather than compete. Nuclei is the cheap, wide sweep for problems the internet already knows about; a person is what turns its output into a decision.

For the site owner and for the developer

For the site owner (plain English)

If a developer says “I ran Nuclei against our site”, they used a free tool that checks your site against a public catalogue of known problems. That is a good thing to have done, and it is not the same as a security review: the tool reports what it recognises, and somebody still has to judge which items matter for your business and in what order. If nobody on your side can do that judging, buying the sweep with the judgement attached is usually cheaper than building the habit internally.

Our external audit runs this exact configuration — safe tags, dangerous ones excluded, duplicates against our passive checks suppressed — and a person reviews every finding before you see it. €290 per domain.

See what the audit covers →

For the developer

Only scan what you own or are authorised to test. Nuclei is loud and attributable; unauthorised scanning is a legal problem, not an etiquette one.
Keep templates fresh (nuclei -update-templates) — the value of the tool is the repository, and it changes daily.
Pin what runs in CI. Template churn means a pipeline gated on “zero findings” will break on somebody else's new template. Gate on severity and a known baseline instead.
Feed it a real target list from subdomain discovery — scanning only the apex misses the hosts that actually get breached.
Triage before filing. Templates tagged panel and exposure have the highest false-positive rate on normal sites; confirm by hand before opening a ticket.
Start passively. The free checkers cover headers, TLS, cookies, CSP and email without sending a single unusual request — do that first and you will have less noise to sort in the nuclei output.

Source: the scanner and its templates are open source — projectdiscovery/nuclei and nuclei-templates.

Nuclei Vulnerability Scanner: Safe Tags, Real Limits, and the Command We Actually Run