See your attack surface the way an attacker does.
SecScan maps your external exposure — TLS, headers, DNS, exposed files and open services — and flags what’s actually being exploited in the wild.
Reads public configuration only. No intrusive testing. No signup.
$ secscan scan example.com→ resolving · TLS · headers · DNS · exposureFAIL ssl-strip exposure no HSTS + plaintextWARN content-security-policy header absentWARN x-frame-options header absentKEV CVE-2023-34362 actively exploitedgrade C · 9 findings · 1 high
- TLS
- Security headers
- Email / DMARC
- Exposed files & secrets
- Open services
- Known-exploited CVEs (CISA KEV)
We flag what’s actually being exploited — not a 200-item checklist.
We flag what’s being exploited
Findings cross-referenced against the CISA Known-Exploited Vulnerabilities catalog. Ransomware-linked issues rise to the top — not buried in a 200-item checklist.
Mapped from the outside
Subdomains, TLS, headers, DNS, exposed files and open services — seen exactly as an external attacker sees them, with no agent to install.
Remediation you can paste
Every finding pairs an observed value with the exact expected one, plus a copy-paste fix for your server, CDN or framework.
A grade, then the fixes.
Every scan returns a clear grade and a ranked, fix-first list of findings.
HSTS not enforced
high- observed
- — (absent)
- expected
- max-age>=31536000; includeSubDomains
Without HSTS a first request can be downgraded to plaintext HTTP and intercepted before the redirect to HTTPS.
Fix: Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
Content-Security-Policy absent
medium- observed
- — (absent)
- expected
- default-src 'self'
No CSP means the browser has no allow-list for scripts, weakening defence against cross-site scripting.
Fix: Add a Content-Security-Policy starting from default-src 'self' and tighten iteratively.
How the pilot works.
Request
Tell us the domain and confirm you’re authorized. Takes a minute.
We scan
An operator runs a full external scan under captured consent — including active checks.
You get a report
A ranked, fix-first report: what’s exploited, what’s exposed, what to do.
Questions, answered.
Is the scan intrusive?
The free checkers are passive — they only read publicly available configuration, the same thing any browser sees. Active checks happen only in the full pilot, under your written authorization.
Do I need to install anything?
No. SecScan scans from the outside, the way an attacker would. There’s no agent and no access to your servers.
What makes this different from a 200-item checklist?
We cross-reference findings against the CISA Known-Exploited Vulnerabilities catalog, so issues that are actually being exploited in the wild rise to the top instead of drowning in low-severity noise.
Is it really free?
The checkers are free and open — no signup. The full external scan pilot is also free; it’s run manually by an operator and returned as a report.
Start your free external scan.
See what an attacker sees in seconds. Passive, open, no signup.