What an attacker sees before they touch your site
Everything an outsider learns about you without sending a single malicious request.
Every guide in this topic
What can someone learn about your site without hacking it?
Before anyone tries the door, they read your whole site from the street. Here is what an outsider learns about you without ever touching your backend.
Your tech stack is public. Does that matter?
Attackers don't guess your framework, your headers announce it. What fingerprinting reveals, why version numbers are a shopping list, and how to quiet it down.
What does "passive scanning" actually mean, and why is it legal?
The scan that never touches your backend is the one that finds the most. What passive scanning is, how it differs from active testing, and why it's legal.
What is a security grade and what does an A vs an F mean?
A stranger can grade your site's security in two minutes from the outside. What an A means, what an F means, and what actually moves the needle between them.
Passive scanner, DAST, or pentest: which one do you actually need?
A passive external scan, a DAST, and a pentest find different things and cost wildly different amounts. What each one sees, what it misses, and when to use which.
What your page source says when you're not looking: internal hosts, dev notes, emails
Your HTML and JS carry leftovers: internal IPs, staging hostnames, TODO comments, scraped-ready emails. None of it is a breach, all of it is intel. How to find it.
Citrix, Ivanti, MOVEit, FortiGate: the edge appliances on CISA's most-exploited list, facing your internet
A VPN gateway, a managed-file-transfer portal, or a Jenkins controller on the public internet is a login page attackers hunt by the thousand. The edge appliances on CISA's known-exploited list, and how to find yours from outside.
Your login config file is published by spec, and it might be pointing at a box on your internal network
The /.well-known/openid-configuration file is world-readable by design. When one of its endpoints resolves to an internal hostname or private IP, it hands strangers a map of your network. How it leaks, and the template fix.
Your OData API will hand a stranger the entire shape of your database, no login required
An OData service publishes its whole data model at $metadata: every entity set, column, key, and relationship. Left open to anonymous requests, it's a free map of your database. How to spot it and lock it down.
Your WAF is doing nothing if origin.yoursite.com answers the public directly
A CDN only protects you if all traffic goes through it. A publicly resolvable origin hostname lets attackers skip the WAF, rate limiting, and DDoS protection entirely. How origin bypass works, and how to close the back door.
Your staging site is public, and Certificate Transparency just told everyone where
Every HTTPS cert you've ever issued is in a public ledger. That's how attackers find the forgotten staging, dev, and admin subdomains you never meant to expose. How to find them first.
Your WordPress is handing out its usernames, and the login page is right where bots expect it
WordPress publishes its author list through the REST API by default, login names and all. Pair that with the standard login page and an attacker has half a credential already. How user enumeration works, and how to stop it.
Your WordPress advertises a relay that can attack other people
An enabled WordPress XML-RPC endpoint carries pingback.ping, which makes your server fetch a URL an attacker picks, so it can be aimed at a DDoS victim or an internal address. WordPress even advertises the relay in a header. How it works, and how to shut it.
Your /metrics endpoint is a live readout of your internals, and it's public
The raw Prometheus /metrics endpoint isn't a dashboard, it's the machine-readable feed behind one. Left public, it leaks internal hostnames, versions, request paths, and sometimes credentials in scrape labels. How it leaks, and how to gate it.
Your front-end is calling an API that hands back everyone's data, not just the logged-in user's
The page loads, fires a quiet fetch, and the response carries hundreds of people's names, emails, and roles. Broken object-level authorization is the most common API flaw there is, and it's readable from the browser. How the leak looks, and how to check.
Your Supabase table has no row-level security, so your anon key reads all of it
A Supabase table with no row-level security is readable by anyone holding the public anon key, which is everyone. How the gap opens in a vibe-coded app, and how to check.
Your API is answering errors with stack traces, SQL errors, and internal paths
An API that returns a raw stack trace, a database error, or an absolute server path on failure is narrating its own internals to anyone who pokes it. Debug error handling left on in production, explained, and how it reads from outside.
Is your GraphQL endpoint handing strangers your entire schema through introspection?
GraphQL introspection is the feature that powers your dev tooling, and left on in production it returns your whole schema, every type and field, to anyone who asks. Even with it off, field suggestions can leak names. How it exposes your API, and how to lock it.
The script tag you added years ago can still run code you didn't write
A <script src> pointing at a compromised CDN, a lapsed domain, or an unclaimed bucket runs attacker code in every visitor's browser. The three ways a trusted script tag turns hostile, and how to find them.
Your assetlinks.json and apple-app-site-association are public by design. Here's what they tell people.
The well-known files that link your site to your mobile apps are required to be public. They also publish your package names, signing fingerprints, Team ID, and deep-link map. What's in them.
Supabase security: what a stranger can reach with your public key
The anon key is public by design; your row-level security is the gate. What a stranger can reach with that public key, and how to check which side of the line your project is on.
API security testing: what it covers, and what a scan sees from outside
API security testing runs from a one-line curl to a full authenticated assessment. What each method finds, where the OWASP API risks sit, and the exposure slice you can check for free.
Penetration testing cost: what a pentest runs, and what runs free first
A 2026 web-app pentest runs $5,000 to $30,000. What drives the price, why a cheap pentest is really a scan, and the free external check to run before you pay for one.
Find it before someone else does.
Paste your domain. The grade and issue count are free, and you'll see in a couple of minutes exactly what's reachable from outside.
External, read-only scan. We only request public URLs - never log in, never send attack traffic.