Plain English, no jargon for its own sake

Every term we use, defined.

The headers, records, and attacks behind a SurfaceCheckr finding, explained in a sentence or two. Search it, or jump to a letter. Each term links to the guide that goes deep.

26 terms

A

Attack surfaceexternal attack surface#: Everything about your site an outsider can reach without logging in or sending an attack: your DNS records, TLS certificate, HTTP headers, exposed files, subdomains, and the technologies your responses announce. The larger it is, the more an attacker has to work with before they try anything.; Why it matters. Most breaches start by mapping the attack surface, so shrinking it removes options before an attack is ever attempted.; External attack surface

C

CAA recordcertification authority authorization#: A DNS record that names which certificate authorities are allowed to issue TLS certificates for your domain. A CA is supposed to check it before issuing. With no CAA record, any public CA may issue a certificate for your name.; Why it matters. It narrows who can mint a valid certificate for your domain, closing off mis-issuance as a path to impersonation.; DNS and email security
Clickjacking#: Clickjacking loads your real page inside an invisible frame on a hostile site and overlays it with decoy content, so a victim who thinks they are clicking the decoy is actually clicking your page, for example approving an action while logged in.; Why it matters. Frame-protection headers stop your pages being embedded and weaponized this way; without them, any site can frame you.; Clickjacking protection
Content Security Policycsp#: A Content-Security-Policy header tells the browser which sources of script, style, and other content it is allowed to load and run on your page. A tight policy is one of the strongest defenses against cross-site scripting, because injected script from an unlisted source simply does not execute.; Why it matters. A good CSP turns many script-injection bugs into non-events; a weak or missing one leaves them fully exploitable.; Content Security Policy
CORScross-origin resource sharing#: Cross-Origin Resource Sharing is the set of response headers that tell a browser which other origins may read your responses. The browser blocks cross-origin reads by default; CORS headers selectively open that up. A wildcard combined with credentials can hand your data to any site.; Why it matters. A permissive CORS policy lets a hostile page read authenticated responses on behalf of your logged-in users.; CORS misconfiguration

D

DASTdynamic application security testing#: Dynamic Application Security Testing runs against a live application and sends real payloads to find bugs like SQL injection and cross-site scripting. It is active by design: it pokes inputs and watches responses. That makes it powerful and intrusive, and different from a passive external scan.; Why it matters. Knowing the difference tells you when you need active testing or a pentest versus a passive read of what is already public.; Passive scanner vs DAST
Directory listingindex of#: Directory listing is when a web server, asked for a folder with no index file, returns an auto-generated list of everything in it instead of an error. That turns a folder of backups, uploads, or config into a browsable index for anyone who finds the path.; Why it matters. An open directory listing hands an attacker a map of files you never meant to advertise, including ones you forgot were there.; Exposed files
DKIMdomainkeys identified mail#: DomainKeys Identified Mail signs your outbound email with a private key, and receivers verify the signature against a public key you publish in DNS. A valid signature proves the message really came from your domain and was not altered in transit.; Why it matters. Without DKIM, a receiver has one less way to tell your real mail from a forgery, weakening your whole email-authentication stack.; Weak DKIM keys
DMARCdomain-based message authentication#: DMARC is a DNS policy that tells receiving mail servers what to do with a message that claims to be from your domain but fails SPF and DKIM: allow it, quarantine it, or reject it. It also asks receivers to send you reports on who is sending as you.; Why it matters. A DMARC policy set to reject is what actually stops spoofed email from reaching your customers' inboxes.; What p=none really means
DNSSECdns security extensions#: DNS Security Extensions cryptographically sign your DNS records so a resolver can verify the answer it got was not forged or tampered with in transit. It protects the integrity of DNS lookups, not their privacy.; Why it matters. Without it, DNS answers can be spoofed; with it broken, your domain can go dark for everyone behind a validating resolver.; DNSSEC validation failure

E

.env filedotenv, environment file#: A .env file holds a project's environment variables, which usually include real secrets: database passwords, API keys, signing secrets. It belongs on the server and out of the web root. Served over HTTP, it hands every one of those secrets to anyone who requests the URL.; Why it matters. A publicly readable .env is one of the most damaging exposures there is, because it leaks live credentials in one download.; Exposed files

H

HSTShttp strict transport security#: HTTP Strict Transport Security is a response header that tells the browser to only ever connect to your site over HTTPS, for a set duration. Once the browser has seen it, it refuses to make a plain-HTTP request to your domain at all, closing the gap before the first redirect.; Why it matters. It removes the initial insecure request an attacker can hijack, so a redirect alone is not enough without HSTS.; Missing HSTS header

M

Mixed content#: Mixed content is an HTTPS page that loads some of its resources, a script, image, or stylesheet, over plain HTTP. The insecure resources travel unencrypted and can be swapped in transit, which is why browsers block or warn on the active kinds.; Why it matters. A single HTTP script on a secure page can be replaced by an attacker on the network and run in your users' browsers.; Mixed content

P

Passive scanpassive scanning, external scan#: A passive scan reads only what a site already serves to the public: its headers, certificate, DNS, exposed files, and page source. It sends no attack payloads, logs into nothing, and writes nothing. It sees exactly what any visitor or attacker sees from outside, and stops there.; Why it matters. It is safe to run on a production site you own without permission or risk, because it only observes what is already public.; Passive reconnaissance
Penetration testpentest, pen test#: A penetration test is a scoped, authorized engagement where a human tester actively attacks your systems to find and prove exploitable weaknesses, including authenticated flows and business logic. It is deep, active, and manual, and it is not something an automated external scan replaces.; Why it matters. For business-logic and authenticated-path risk, a pentest is the right tool; a passive scan handles the public surface first.; Passive scanner vs pentest

R

Remote code executionrce#: Remote code execution is a class of vulnerability that lets an attacker run their own code on your server from across the network. It is close to the worst outcome a single bug can produce, because it typically hands over the whole machine and everything it can reach.; Why it matters. An internet-facing service with a known RCE is a top-priority fire, because exploitation gives an attacker full control.; Vulnerable dependencies

S

security.txt#: security.txt is a small text file at /.well-known/security.txt that publishes how to report a security issue to you: a contact, a policy link, an optional encryption key. It is a convenience for good-faith researchers, not a control, and its absence is not a vulnerability.; Why it matters. Having one gives a researcher who finds a problem a clear, fast way to tell you before anyone else finds it.; What security.txt is for
Source map#: A source map (.map file) links minified production JavaScript back to the original, readable source so developers can debug. Served publicly, it reconstructs your un-minified code, comments and all, for anyone who fetches it, which can reveal internal logic and stray secrets.; Why it matters. A public source map turns your shipped bundle back into browsable source, undoing the little obscurity minification gave you.; Source maps in production
SPFsender policy framework#: Sender Policy Framework is a DNS record that lists which mail servers are allowed to send email for your domain. A receiving server checks the sending IP against your SPF record; a message from an unlisted server fails the check.; Why it matters. Without SPF, anyone can send mail claiming to be from your domain, and receivers have no published rule to reject it.; SPF and email spoofing
SSRFserver-side request forgery#: Server-Side Request Forgery tricks your server into making a request an attacker chose, often to an internal address the attacker cannot reach directly. It is used to pull cloud metadata credentials, hit internal services, and pivot inside a network from a single outward-facing input.; Why it matters. SSRF turns your own server into a proxy into your internal network, which is why scanners themselves must defend against it.; External attack surface
Subdomain takeover#: A subdomain takeover happens when a DNS record still points at a third-party service (a cloud host, a CDN, a SaaS app) that you no longer own on that platform. An attacker registers the abandoned resource and now serves content from your subdomain.; Why it matters. A dangling subdomain lets an attacker host their content under your trusted domain, which is ideal for phishing and cookie theft.; Exposed and dangling subdomains
Subresource Integritysri#: Subresource Integrity is an integrity attribute on a script or stylesheet tag that carries a cryptographic hash of the expected file. The browser fetches the resource, hashes it, and refuses to run it if the hash does not match, so a swapped third-party file is blocked.; Why it matters. SRI is what stops a compromised CDN from silently serving altered script to every visitor of your page.; Subresource Integrity

T

TLStransport layer security, ssl#: Transport Layer Security is the protocol that encrypts the connection between a browser and your server, the S in HTTPS. It relies on a certificate that proves your identity and a key exchange that no one on the network can read. SSL is its older, deprecated name.; Why it matters. TLS is what makes traffic private and tamper-evident; a weak, expired, or mismatched certificate breaks that guarantee visibly.; TLS certificate weaknesses

V

Vibe coding securityai coding security, ai-generated code security#: The practice of finding and closing the security holes an AI coding assistant leaves behind when you build an app by prompting a model. The app works before anyone checks what it exposed, so a secret key in the browser, a database table with no access rule, or an over-sharing API can ship unnoticed.; Why it matters. Code an assistant writes is not secure by default, and the exposures it ships are readable from outside your app.; Vibe coding security

W

Website securityweb security, site security#: The practice of protecting a website and its data from being read, changed, or abused by people who should not have access. It splits into what an outsider can reach without logging in (exposed files, leaked keys, weak headers, spoofable email, vulnerable libraries) and what a logged-in user can do beyond their permissions.; Why it matters. Most incidents begin with the outsider half, which is the cheapest to check and the first thing an attacker probes.; The website security checklist

X

Cross-site scriptingxss#: Cross-site scripting is a vulnerability where an attacker gets their own JavaScript to run in another user's browser on your site, usually by slipping it through an input your page reflects or stores without escaping. That script then runs with your user's session and permissions.; Why it matters. XSS lets an attacker act as your logged-in users, which is why Content Security Policy and output escaping matter so much.; How CSP defends against XSS

Find it before someone else does.

Paste your domain. The grade and issue count are free, and you'll see in a couple of minutes exactly what's reachable from outside.

External, read-only scan. We only request public URLs - never log in, never send attack traffic.