Subdomains and forgotten hosts
Hostnames tied to your domain, found through public sources and certificate records, so old test, staging and campaign sites come into view.
Free external scan for one domain
External attack surface scanning
Every domain, server and service your business exposes to the internet, found and checked for weaknesses.
Then a plain-language report on what to fix first.
What attackers see first
Attackers rarely start with your front door. They start with everything else you have online.
Your attack surface is bigger than your website
A test server nobody switched off. A subdomain still pointing at a cancelled service. A database port opened for one afternoon. An admin login on the default path. Each one is visible to anyone who looks, and automated attackers look all the time.
We find them the way they do: from the outside, with no access, passwords or software installed on your side.
Your domain Your report
Discover
Check
Rank
Report
Outside-in, the way an attacker would look
What we check
Twelve kinds of checks, run across your domain and the hosts we discover behind it.
Open ports and exposed services
What answers from the internet, which software and version it runs, and which services should never be public, such as databases or remote desktop.
Known vulnerabilities
Detected software versions checked against public vulnerability databases, plus thousands of checks for known exposures and misconfigurations.
Web server and application issues
Misconfigurations, default files and outdated components on your web servers, and a passive review of the live application as we crawl it.
Exposed files and admin panels
Backups, database dumps, configuration and source-control files, and login pages that are reachable when they shouldn't be.
Leaked keys in your code
API keys, tokens and credentials accidentally shipped in the JavaScript your site sends to every visitor.
Encryption and certificates
Certificate validity and expiry, protocol versions and cipher strength on every service that uses encryption.
Browser security headers
Whether your sites tell browsers to enforce HTTPS, restrict scripts and refuse to be framed: protections many sites still lack.
Email spoofing protection
SPF, DKIM and DMARC on your domain and its subdomains. Can someone send email that looks like it came from you?
Subdomain takeover
DNS records still pointing at services you no longer use, which an attacker could claim and serve content from under your name.
Public cloud storage
Storage buckets named after your brand that are open for anyone to list, read or write.
AI-assisted review
A read-only, AI-assisted pass over your web application to catch logic and configuration issues that fixed checks miss.
A report you can act on
Written for the person who has to fix things, and the person who has to approve the work.
A score out of 100
One security score and an A to F grade for your whole external surface, so you can see where you stand and measure progress after fixes.
Every finding, ranked
Each issue rated from critical to informational, with where we found it and the evidence behind it.
What to fix first
Plain-language remediation for each finding, and a prioritised list of recommendations for the whole surface.
Start free, go deeper when you need to
The free scan shows you where you stand. A full assessment covers everything.
A quick external scan of one domain
- The domain you name and the subdomains we discover
- The 1,000 most commonly used ports
- The same check categories, at quick-scan depth
- Your report, sent to you by email
- No obligation and no follow-up campaign
Your whole external surface, in depth
- All of your domains, scoped with you before we start
- Every port, all 65,535 of them
- Deeper subdomain and content discovery
- The full set of vulnerability checks
- Repeat scans to confirm your fixes worked
How the free scan works
Four steps, and nothing to install.
Tell us your domain
Fill in the form below. Using an email address at the domain you want scanned speeds things up.
We confirm you're authorised
We only scan domains you own or have permission to test. We reply within one business day to confirm, usually through an address at that domain.
We scan from the outside
No access, passwords or installs. The checks detect weaknesses; they don't exploit them, change data or try to take anything down.
You get the report
We send it to you and only you. Ask us anything about it, with no obligation to buy.
Free external scan
Request your free scan
One domain, outside-in
The domain you name and the subdomains we discover from public sources.
Only with permission
Confirm you own the domain or are authorised to have it tested. We check before we start.
Your results stay private
The report goes to you. We don't publish findings or share them with anyone else.
No sales sequence
No newsletter and no follow-up campaign. If you want more, you ask.
Questions first? Email us at [email protected]
Questions
What people usually ask before their first scan.
Is it safe to run against my live website?
Yes. The checks are built for production systems and their request rates are capped. They look for weaknesses rather than exploiting them, and they don't change data or try to take services down. If you have a fragile system or a maintenance window, say so in the form and we'll plan around it.
Do you need access, passwords or anything installed?
No. External scanning looks only at what anyone on the internet can already reach. You don't give us credentials and nothing is installed on your systems.
Why do I have to confirm I'm authorised?
Scanning systems without permission can be unlawful, and the domain in a form might not belong to the person filling it in. So we only scan domains you own or are authorised to have tested, and we confirm that with you before we start.
Is this the same as a penetration test?
No. A scan finds and checks your exposed systems at scale. A penetration test goes further: people manually try to exploit what they find. A scan is the sensible first step, and its results show where deeper testing is worth paying for.
Will my firewall or hosting provider notice the scan?
They might. Firewalls and security services can log or block scanning traffic, which is a good sign that they're watching. If you'd like us to coordinate with your IT provider or host first, tell us in the form.
What happens after the free scan?
You keep the report. If you want help fixing what we found, or a full assessment, reply and we'll scope it with you. If not, that's the end of it.
See what attackers see
One domain, outside-in, free. Start with a short form.