See your site the way
attackers do.
Passive web security audit for SSL/TLS certificates, HTTP security headers, and DNS posture — in seconds.
Free instant scans — no sign up required. Fast. Private. Actionable.
How It Works
Enter Your Domain
Simply input your domain name for a free instant check — no agents to install, no DNS delegation, and no signup barrier.
100% Passive Analysis
SurfaceScan connects just like an external browser: inspecting public DNS, TLS handshakes, and headers in seconds.
Direct Copy-Paste Fixes
Every missing parameter comes with exact Nginx, Apache, or Cloudflare configuration lines and a shareable report link.
9 Critical Security Pillars
Every audit evaluates your public perimeter against modern security standards and compliance expectations.
SSL / TLS Certificate
Certificate validity, root chain trust, TLS 1.2/1.3 protocol enforcement, and expiration warnings.
HTTPS Redirection
Mandatory 301 permanent redirection from plain HTTP to TLS encrypted endpoints.
HTTP Security Headers
HSTS, Content-Security-Policy (CSP), X-Frame-Options, X-Content-Type-Options, and Permissions-Policy.
Cookie Security & CORS
HttpOnly, Secure, and SameSite cookie attribute enforcement alongside wildcard CORS vulnerability audits.
Third-Party Scripts & SRI
Subresource Integrity (SRI) hashes and audits of untrusted CDN JavaScript tags.
DNS Email Authentication
SPF, DKIM, and DMARC enforcement records preventing attackers from forging emails from your domain.
DNS CAA Records
Explicit Certificate Authority Authorization restricting unauthorized certificate issuance.
Subdomain Attack Surface
Detection of dangling CNAME records pointing to decommissioned AWS, GitHub, or Heroku instances.
Public Files & Configurations
Inspection of security.txt, robots.txt, exposed git metadata, and sensitive server leaks.
SurfaceScan vs Traditional Tools
| Metric | Invasive Scanners | Port Scanners (Nmap) | SurfaceScan |
|---|---|---|---|
| Server stability risk | High (can crash sites) | Network load & bans | Zero risk (100% passive) |
| Legal authorization | Strict consent required | Network owner permission | Instant on any domain |
| Report readability | Obscure CVE jargon | Raw port numbers | Plain language & A-F grade |
| Remediation guides | Theoretical advice | No remediation provided | Ready Nginx/DNS configs |
| Access & Pricing | Expensive enterprise fees | Terminal tooling required | Free instant scans · Pro $5/mo |
AI Security Advisor
Engineering Rigor, No Fear Marketing
Our AI advisor prioritizes vulnerabilities strictly by real-world risk and implementation effort. No fear marketing or false alarms — only grounded, verified facts.
Every finding includes copy-pasteable configuration directives formatted specifically for your web server.
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
# Block frame clickjacking
add_header X-Frame-Options "DENY" always;
Shareable Report Links
Generate an unguessable 128-bit persistent report link to share with clients or engineering teams. Reports expire after 30 days and are excluded from search engine indexes.
Clean PDF Export
Archive your audit as a clean PDF document. Click "Export PDF" or press Ctrl+P to generate a clean A4 audit sheet free of advertising or UI clutter.
Frequently Asked Questions
How do I check my website security online?
Enter your domain name in the input box above and click "Scan". SurfaceScan immediately retrieves your SSL certificate, verifies HTTP defensive headers, and tests your email authentication records within seconds.
Why is domain security posture important?
A large fraction of web attacks exploit missing HTTP headers (like HSTS and Content-Security-Policy), invalid SSL chains, or missing email authentication records (SPF, DMARC), which leave domains exposed to spoofing, clickjacking, and man-in-the-middle attacks.
Does SurfaceScan test or attack my website?
No. SurfaceScan is strictly non-invasive. We do not test exploits, brute force passwords, or flood servers with request traffic. Everything tested is publicly observable information.
How can I improve my security score to A+?
After running a scan, review the prioritized findings in the "AI Security Advisor" section. Copy the provided Nginx or Apache lines into your configuration and reload your web server.
Is SurfaceScan free or paid?
On-demand security checks are free forever with up to 3 watchlist domains and starter API quotas (30 req/min). For teams needing up to 50 monitored domains, 4x API limits (120 req/min), and automated email, Telegram, or webhook drift alerts, SurfaceScan Pro is available for $5/month.
Audit your domain today.
Uncover missing security headers and external perimeter exposure in seconds.