External surface
Everything your domain publishes, read back to you.
An attacker starts where you cannot see: the headers you forgot to send, the protocol you never disabled, the staging host in a certificate log. This reads all of it from the outside, the same way they would.
Per assessment
7
Check families
5
Severity levels
0
Payloads sent
Passive assessment sends no payloads. Active exposure checks unlock only after domain ownership is proven.
What it finds
Pick a check. See what it actually returns.
Real output shapes from the scanner — evidence line, severity, confidence, and the fix. Hover, click, or use the arrow keys.
Looks for
- Strict-Transport-Security
- X-Content-Type-Options
- X-Frame-Options
- Referrer-Policy
- Permissions-Policy
Example output
Missing HTTP Strict-Transport-Security (HSTS) header
high- Evidence
- Response from https://example.com/ contained no Strict-Transport-Security header.
- Recommendation
- Send Strict-Transport-Security with a max-age of at least 31536000 and includeSubDomains, so a browser that has seen the site once refuses to downgrade to plaintext.
Confidence · ConfirmedClassification · CWE-319
Boundaries
What it will never do to your site.
A scanner you cannot safely point at production is a scanner you will not run. The limits are the feature.
Passive by default
Every check above is the traffic a browser already generates — a request, a handshake, a DNS lookup. Nothing is fuzzed, nothing is brute-forced, no payload is submitted.
Active checks need proof of ownership
Exposure checks that probe for files like .git or .env stay locked until you prove the domain is yours with a DNS TXT record or a file served from a well-known path.
Rate-limited and bounded
Response bodies are read up to a cap, every external call carries a timeout, and scan submissions are limited per account, so an assessment cannot become a load test.
Keep reading
Where most people go next
Read your own surface first.
One domain, free, no card. You will know within a scan whether this tells you something you did not already know.
Start free assessment