Know your external attack surface
before attackers do

Surface Scanner is a free domain security scanner that analyses your website's external attack surface across 23 parallel modules in roughly 30 seconds. It checks TLS configuration, security headers, DNS records (including SPF/DKIM/DMARC), exposed secrets, sensitive paths, cloud bucket leaks, open redirects, cookie security, domain registration data via RDAP, security.txt presence, HSTS preload status, and subdomain takeover risk. Each scan returns an A+ to F security grade plus actionable remediation steps. No signup required.

SSL Labs is excellent at TLS analysis — a single module that goes deep on certificate chains, ciphers, and protocols. EchelonGraph Surface Scanner runs that same TLS analysis as one of 23 parallel modules, then adds 11 more checks SSL Labs doesn't perform: security headers (CSP, HSTS, COEP/COOP/CORP), DNS authentication records, secret leak detection across 30+ patterns, cloud bucket exposure across 11 providers, subdomain takeover risk via Certificate Transparency logs, RDAP domain expiry tracking, and more. If you want only TLS, SSL Labs is great. If you want a complete external attack surface picture, our free scan covers all of it.

Yes — EchelonGraph Surface Scanner includes a security headers checker as one of its 23 free modules, validating the same set securityheaders.com grades (CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, HSTS) plus modern additions like Cross-Origin-Embedder-Policy (COEP), Cross-Origin-Opener-Policy (COOP), and Cross-Origin-Resource-Policy (CORP). Unlike securityheaders.com, our scan combines header analysis with TLS, DNS, subdomain takeover detection, secret leak scanning, and domain expiry checks in a single 30-second run.

Hardenize and Mozilla Observatory both run useful multi-check audits — hardenize covers around six categories, Mozilla Observatory around four. EchelonGraph Surface Scanner runs 23 modules free with three unique additions no free competitor offers: RDAP-based domain expiry and registrar tracking, subdomain takeover detection via Certificate Transparency log enumeration with 25+ service fingerprints, and cloud bucket exposure scanning across 11 providers (AWS S3, GCS, Azure Blob, DigitalOcean, Backblaze, Alibaba OSS, Firebase, Wasabi, MinIO, OVH, Oracle OCI). All free, no signup, 30-second scan time.

Yes. The Subdomain Takeover module enumerates your domain's subdomains via Certificate Transparency logs (crt.sh and certspotter), resolves each CNAME chain, and matches against a curated fingerprint database of 25+ takeover-vulnerable services including AWS S3 static-website hosting, GitHub Pages, Heroku, Netlify, Vercel, Shopify, Fastly, Webflow, Tumblr, Pantheon, and others. When a CNAME pattern matches, we HTTP-fetch the subdomain and grep the response for the service's 'no such site' marker string to confirm. Confirmed dangling CNAMEs are flagged CRITICAL.

Yes. The Domain Info module performs a live RDAP (Registration Data Access Protocol) lookup against the authoritative TLD registry — Verisign for .com/.net, Public Interest Registry for .org, Identity Digital for .io/.ai/.info, Nominet for .uk, Denic for .de, Google Registry for .dev/.app, and others. We surface the registrar name, original registration date, expiration date (with CRITICAL severity if expiring in under 7 days, HIGH within 30 days), DNSSEC delegation status, nameservers, and a relative-time interpretation. Newly-registered domains (under 30 days) are flagged as a phishing signal.

Roughly 30 seconds for most targets, with a hard 60-second deadline. All 23 modules run in parallel — slow modules don't block fast ones. Typical timing: TLS, headers, DNS, cookies, and buckets each finish in under 3 seconds; HSTS preload check and security.txt usually under 2 seconds; RDAP domain lookup under 5 seconds; sensitive path scan around 20 seconds (it probes 200+ paths); subdomain takeover around 5-10 seconds depending on how many subdomains your domain has. Result page renders the grade, finding counts by severity, and full breakdown immediately when the last module finishes.

The 23-module scan is permanently free with no signup, no credit card, and no scan limit per domain (rate-limited to one scan per IP every 5 minutes to prevent abuse). Free scans run forever. The Pro plan unlocks 9 additional modules (CORS deep-scan, web crawler, PII bundle detection, forms analysis, tech fingerprinting, port scanning, token analysis, plus opt-in active probes for login + password-reset enumeration) plus scan history, branded PDF reports, scheduled monitoring with grade-change alerts, and integration with the wider EchelonGraph attack-surface management platform. Pro pricing starts at $49/user/month.