Policy & DNS record builders
Generate standards-compliant policies offline right in your browser — test strict Content-Security-Policy headers, stay below the RFC 7208 10-lookup SPF limit, and build RFC 9116 security.txt files.
Content-Security-Policy Builder
Build an A+ defense header and verify it avoids risky script directives.
SPF & DMARC Builder
Track RFC 7208 DNS lookup budget in real time so mail receivers never fail SPF with PermError.
Note: Make sure the rua= mailbox really exists before publishing. Progress safely from p=none → p=quarantine → p=reject after verifying legitimate DKIM/SPF alignment.
RFC 9116 security.txt Generator
Publish vulnerability disclosure instructions at /.well-known/security.txt with a valid future RFC 3339 expiry.
Public API Endpoints & Live Tester
Base URL: https://surfacescan.uk · Test unauthenticated (8/min per IP) or with an API key (30/min Free · 120/min Pro).
/api/scan?domain=example.com
Runs passive DNS, TLS, header, mail & CT checks. Optional &lang=az|en.
/api/compare?a=example.com&b=stripe.com
Side-by-side posture score comparison for two distinct domains.
/api/advice?scanId=<id>
Prioritized remediation advice for a recent scanId.
/badge/<domain>.svg
Embeddable SVG security grade badge (and /healthz uptime check).
{
"scanId": "scan_example",
"domain": "example.com",
"score": 82,
"grade": "B",
"summary": "HTTPS and TLS are properly configured, with minor header improvements available.",
"checks": [
{ "id": "https", "label": "HTTPS & Redirect", "status": "good" },
{ "id": "hsts", "label": "HSTS Header", "status": "good" }
]
}