Frequently asked questions

SecScan is an external attack-surface scanner. It looks at a website the way an attacker would — from the outside, with no access to your servers — and reports what is exposed and what is worth fixing first. It offers free passive checkers for HTTP security headers, TLS, and email authentication (SPF/DKIM/DMARC), plus a deeper full external scan run on request. Its distinguishing feature is that findings are cross-referenced against the CISA Known Exploited Vulnerabilities (KEV) catalog, so issues actually being exploited in the wild rise to the top instead of drowning in a long checklist.

Yes. The security checkers — Security Headers, Website Security Score, and Email/DMARC — are completely free and open, with no account, no email, and no card required. The full external scan is also free during the current pilot; it is run manually by an operator and returned to you as a report. There is no paid self-serve tier today. See the pricing page for the full breakdown.

No. The checkers are deliberately open with no signup — you enter a domain and get the result immediately. The only thing that requires your details is requesting the full external scan, because we need to know who is authorizing the scan and where to send the report.

The free checkers are passive. They read only the public configuration your site already exposes to any visitor — the same thing a browser or a single curl request sees — and perform no intrusive testing: no logins, no form submissions, no fuzzing, no exploitation. A scan is comparable in impact to a handful of normal page loads. Active checks happen only in the full external scan, and only under your written authorization.

The Security Headers checker grades your HTTP response headers (HSTS, CSP, X-Frame-Options and more). The Email/DMARC checker reads your public SPF, DKIM, DMARC and MX records to tell you whether your domain can be spoofed. The Website Security Score combines your headers, TLS/SSL configuration, and any publicly exposed files into a single A–F grade. Each finding comes with a plain-English explanation and a copy-paste fix.

The score combines three weighted, passive signals — HTTP headers, TLS configuration, and exposed files — plus an informational technology fingerprint. Each category starts at 100 and loses points by severity, then the weighted result maps to a 0–100 number and an A–F letter. Hard caps apply: any critical issue caps the grade at F and any high-severity issue caps it at C, so a strong average can never hide one serious leak. The full method is in the website security guide.

Because inferring a CVE from a version banner is unreliable and produces false criticals — vendors backport patches without changing version numbers, and banners are often spoofed or stripped. A result you cannot trust is worse than no result, so the open tools stick to signals they can directly observe. Known-exploited-vulnerability (CISA KEV) checks are reserved for the full external scan, where there is enough verified context to report them responsibly.

No. Checker results are generated for your request and shown in your browser; they are not saved to a public page and are not indexed by search engines. You can re-run a check any time to get a fresh read.

The full external scan goes beyond the passive checkers: it can cover subdomains, open services, and known-exploited (CISA KEV) vulnerabilities, and it includes active checks that the free tools deliberately avoid. It is run manually by an operator under your written authorization and delivered as a ranked, fix-first report. It is coming soon — see the full-scan page.

No. SecScan scans entirely from the outside, the way an attacker would. There is no agent to install and no access to your servers or code required.

Anyone responsible for a website's security posture — founders, developers, sysadmins, and security teams — who wants a fast, honest read of what is exposed externally and what to fix first. It is useful both as a quick self-check before shipping and as a way to track your posture over time.

No, and it is not meant to be. The checkers are a passive hygiene check that catches the common, externally visible mistakes behind most opportunistic breaches. A penetration test is an active, in-depth assessment by a skilled human of your application logic, authentication and internal systems. SecScan is an excellent first line of defence and a great way to monitor posture, but high-stakes systems still warrant a full pentest.