About SurfaceScan
Clear, quiet domain security analysis built for modern web creators, engineers, and founders.
Why SurfaceScan Exists
Most security scanners are built like cyber-hacker cockpits from the 1990s: neon dials, confusing risk metrics, synthetic alarm bells, and predatory upsells trying to sell you an enterprise firewall before you've even diagnosed your problem.
In reality, the vast majority of web vulnerabilities stem from simple, fixable misconfigurations: a missing HSTS header that allows cookie theft on coffee shop Wi-Fi, an unconfigured SPF record enabling email spoofing, or a dangling DNS record pointing to an abandoned cloud bucket.
SurfaceScan exists to provide an editorial, calm, and transparent view of your domain security. We tell you exactly what is misconfigured, explain what attack it invites in plain language, and give you copy-paste fixes for your hosting stack.
How It Works
Every scan is strictly passive and zero-intrusion, executing across four parallel phases:
- Resolve public DNS records: We query standard authoritative DNS records for your apex domain and subdomains (A, AAAA, MX, TXT, CAA, and CNAME).
- Inspect TLS handshake: We connect to port 443 with SNI to examine the public certificate chain, expiration date, key size, and supported cryptographic ciphers.
- Read public HTTP response headers: We issue a standard GET request to your website root to observe defensive headers like HSTS, CSP, and X-Content-Type-Options.
- Check public well-known files: We check for RFC 9116
/.well-known/security.txtand standard/robots.txtpolicies.
Core Principles
Never Invasive
We never attempt authentication bypass, fuzz parameters, or exploit weaknesses. Inspect every request we make on our Scanner Info & Opt-Out page.
Actionable Directives
A security finding is useless without remediation code. Every issue comes with tailored snippets across 10 platforms including Nginx, Apache, Caddy, Vercel, Netlify, Cloudflare, Next.js, Express, IIS, and WordPress.
No Synthetic Alarmism
Missing headers are presented as misconfigurations to be resolved quietly, not catastrophic emergencies designed to induce panic.
Privacy First
Instant audits require no account, and we never track visitors or sell advertising beacons. Signing in is optional and only needed for saved watchlists, Personal API keys, or Pro monitoring.
Frequently Asked Questions
Is it legal to scan any public domain?
Yes. SurfaceScan performs the exact same network queries that your web browser makes when loading a site (DNS lookup, TLS handshake, and standard GET request). No protected networks or private services are touched.
Why did my grade drop from A to B or C?
Security standards evolve. If an SSL certificate is nearing expiration (< 14 days), if a newly added third-party script lacks SRI hashes, or if your DMARC record is set to p=none, deductions will be reflected in the updated score.
Can I opt my domain out of being scanned?
Yes. Publish a DNS TXT record at _surfacescan.<yourdomain> with the value optout or submit a removal request via Contact. See the full Scanner Info & Opt-Out documentation.
Can I scan an internal development IP (e.g. 192.168.1.1)?
No. SurfaceScan enforces rigorous Server-Side Request Forgery (SSRF) filters. All requests to private IP subnets, loopbacks, link-local addresses, and carrier-grade NATs are immediately rejected before network connections occur.
Is SurfaceScan free to use?
Yes for on-demand domain audits, policy builders, and starter limits (3 watchlist domains and 30 req/min API quota). If you want continuous scheduled monitoring for up to 50 domains, higher API limits (120 req/min), and automated drift alerts, see our SurfaceScan Pro plan ($5/month).
Get in Touch
Have a question about our methodology, want to suggest an improvement, or need assistance interpreting your audit report?