MySecScan maps your external exposure — TLS, headers, DNS, exposed files and open services — and flags what’s actually being exploited in the wild.
Reads public configuration only. No intrusive testing. No signup.
$ secscan scan example.com→ resolving · TLS · headers · DNS · exposure[dns] 3 subdomains · 2 mx · spf ok[tls] TLS1.3 · cert valid 78d[headers] 4 / 7 presentFAIL ssl-strip exposure no HSTS + plaintextWARN content-security-policy header absentWARN x-frame-options header absentINFO server: nginx version hiddenKEV CVE-2023-34362 actively exploited[kev] 1 match · ransomware-linkedgrade C · 9 findings · 1 high · 2 medium$
Findings cross-referenced against the CISA Known-Exploited Vulnerabilities catalog. Ransomware-linked issues rise to the top — not buried in a 200-item checklist.
KEV CVE-2023-34362 actively exploited↳ ransomware-linked · patch now
Subdomains, TLS, headers, DNS, exposed files and open services — seen exactly as an external attacker sees them, with no agent to install.
Every finding pairs an observed value with the exact expected one, plus a copy-paste fix for your server, CDN or framework.
HSTS, CSP, X-Frame-Options and more — pass/fail with exact fixes.
Run checkA–F grade across headers, TLS and exposed files in one read.
Run checkSPF, DMARC and DKIM — is your domain spoofable?
Run checkCertificate expiry, chain, hostname match and TLS protocol — instant read.
Run checkDoes your login page stop bots from brute-forcing passwords? Find out in seconds.
Run checkSecure, HttpOnly and SameSite — are your session cookies protected?
Run checkContent-Security-Policy, directive by directive — with a hardened version to copy.
Run checkEvery subdomain in your certificate history — live, third-party or dangling.
Run checkEvery scan returns a clear grade and a ranked, fix-first list of findings.
Without HSTS a first request can be downgraded to plaintext HTTP and intercepted before the redirect to HTTPS.
Fix: Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
No CSP means the browser has no allow-list for scripts, weakening defence against cross-site scripting.
Fix: Add a Content-Security-Policy starting from default-src 'self' and tighten iteratively.
Tell us the domain and confirm you’re authorized. Takes a minute.
An operator runs a full external scan under captured consent — including active checks.
A ranked, fix-first report: what’s exploited, what’s exposed, what to do.
MySecScan is an external attack-surface scanner for small teams and the agencies that look after their websites. It checks a domain the way an attacker's tooling does — from the outside, passively — and explains what it finds in plain English for the owner, with the exact fix for the developer. Eight free checkers cover subdomains, headers, cookies, CSP, TLS, email authentication and login protection; the Domain Monitor watches for cloned sites, lookalike certificates and typosquat registrations; and an operator-run full scan goes deeper on request. Start with what attack surface management means for a small business.
The free checkers are passive — they only read publicly available configuration, the same thing any browser sees. Active checks happen only in the full pilot, under your written authorization.
No. MySecScan scans from the outside, the way an attacker would. There’s no agent and no access to your servers.
We cross-reference findings against the CISA Known-Exploited Vulnerabilities catalog, so issues that are actually being exploited in the wild rise to the top instead of drowning in low-severity noise.
The checkers are free and open — no signup. The full external scan pilot is also free; it’s run manually by an operator and returned as a report.
See what an attacker sees in seconds. Passive, open, no signup.