What can attackers see from the outside?
Enter your domain. We check your website, email spoofing protection, domain registration and exposed services using public records only, and grade what we find.
Website security
HTTPS and certificate expiry, the http-to-https redirect, security headers, software versions your server gives away, and out-of-date WordPress.
Email spoofing protection
SPF, DMARC and DKIM: the records that stop criminals sending email that looks like it came from you.
Domain hygiene
Registrar transfer lock, domain expiry, DNSSEC, and lookalike domains that someone has registered and set up for email.
Exposed services
Remote desktop, Windows file sharing, databases, old VPNs and other services on your public addresses, from Shodan’s existing internet data.
Has your email been in a data breach? Run the free Dark Web Scan →
Is this a scan of my network?
No. We only read public records: DNS, the domain registry, certificate logs and Shodan’s existing data, plus one ordinary visit to your homepage, the same as any visitor. Nothing on your network is scanned or probed.
Why is my grade low?
Most small business domains miss a few of these. The items marked “Fix now” are the ones attackers use most. The full report explains each one and how to fix it.
What doesn’t this cover?
Everything inside: patching, backups, MFA, endpoint protection and how your team handles phishing. The Resiliency Scorecard covers those in about 3 minutes.
Exposed-service data from Shodan. Limited to a few checks per hour from each network.