External attack-surface scanner

Scan your website like an attacker would.

Get a security score in under a minute, plus a PDF report with a recommended fix for every issue. Free with an account.

Only scan websites you own or are authorised to test. The scan is an external check of your public website and DNS.

  • 6attack surfaces
  • <60sper scan
  • OWASPTop 10:2025 mapped
  • PDFreport with fixes

01 Attack surface

What we check

Six layers attackers probe first, all tested from the outside in, exactly as they would see your site.

  • Free report

    HTTPS & TLS

    Certificate validity, HTTP→HTTPS redirect, HSTS, mixed content, and whether only modern TLS (1.2+) is accepted.

    • TLS 1.2+
    • HSTS
    • Redirects
    • Mixed content
  • Free report

    Security headers

    Content-Security-Policy, clickjacking protection, cross-origin policies, cookie flags, caching and CORS.

    • CSP
    • X-Frame-Options
    • CORS
    • Cookies
  • Free report

    Exposed files & consoles

    .env, .git, dependency manifests, debug endpoints and admin consoles that should never be public.

    • .env
    • .git
    • Debug
    • Admin panels
  • Free report

    Secrets in the page

    API keys, access tokens and private keys accidentally shipped in your public HTML and JavaScript.

    • API keys
    • Tokens
    • Private keys
  • Free report

    Vulnerable packages

    Detects the libraries your site ships and checks them against known vulnerability databases.

    • JS libraries
    • Known CVEs
  • Free report

    Email & DNS

    SPF, DMARC, DKIM, MTA-STS, DNSSEC and CAA: whether scammers can send email that looks like it came from you.

    • SPF
    • DMARC
    • DKIM
    • DNSSEC
    • CAA

02 Scan console

See your site the way attackers do

CyberScan runs the same reconnaissance an attacker would: it resolves your DNS, shakes hands with your server, probes for leaked files and reads what your pages ship.

  • Mapped to OWASP Top 10:2025Findings are tagged with the OWASP category they belong to.
  • A fix for every findingEach issue comes with a plain-English recommended action.
  • Scored A to FA 0–100 score and a letter grade you can share with your team.

03 How it works

From domain to report in three steps

  1. 01

    Create a free account

    Sign up with your email in seconds. No card needed.

  2. 02

    Enter your website

    Type your domain and your organisation name. The scan takes under a minute.

  3. 03

    Get your PDF report

    See your score straight away, then open or download the full report with a recommended fix for every finding.

04 Ready when you are

Find the gaps before someone else does.

One scan shows you what's exposed and exactly how to fix it. It’s free with an account.

Start your free scan →