Security scanners
Four scanners for the four layers an outsider can reach. Each answers a different question, each produces a grade from A+ to F, and each keeps what it finds so the next scan has something to be compared against.
Free security scanners for TLS, ports, HTTP and DNS
Online port scanner
What is this estate willing to talk to a stranger about? Open ports with the service and version behind each one, the way an outsider sees them. Powered by Nmap.
SSL/TLS checker
Is the encryption sound, and when does the certificate expire? Protocol versions, cipher suites, certificate chain and validity dates. Powered by testssl.sh.
HTTP security checker
Is the web application configured defensively? Security headers and the technologies the server reveals, checked for free. Known web weaknesses too, once you sign in for the OWASP ZAP-powered scan.
DNS security checker
Can anyone send mail that looks like it came from you? SPF, DKIM (bring your own selector), DMARC, MTA-STS and TLS-RPT, plus DNSSEC and the records themselves.
Within DNS, two records decide whether your domain can be impersonated:
DNSSEC checker
Is your DNS signed and validating?
SPF checker
Which servers may send as your domain?
DKIM checker
Is the DKIM record present for your selector?
DMARC checker
What happens to mail that fails the check?
MTA-STS checker
Is a mail transport security policy published?
What makes these different from the dozens of free scanners
Most online scanners will check any address you type, dress the result up as a full assessment, and call it done. That is convenient, and it is also why this space is full of reports nobody takes seriously.
The free tools, and what's above them.
It finds more, too. A fifth scan type, Credibility, runs only there - DNSBL listings, RDAP/WHOIS and abuse and threat-intel sources. The other four go deeper as well: TLS adds a check for named vulnerabilities like Heartbleed and POODLE, ports get matched against a CVE database instead of just identified, HTTP is scanned by OWASP ZAP instead of a single request, and DNS adds zone transfer exposure, wildcard records, open resolvers, subdomain takeover risk and dangling records. Scans also run on a schedule instead of once, and results export as PDF or through the API.
The four free tools on this page don't play that game.
Each one runs a live check against your actual infrastructure - a real network scan, a real negotiation with the host over TLS, a real HTTP request read for its headers, cookies and technology - rather than a database lookup dressed up as one. Each says plainly what it covers and what it doesn't, and none of them ask who you are first: no account, just IP rate-limiting and a rule that a target has to be a real, public address before anything gets scanned. Read your result once - it lives in memory for about fifteen minutes and you can download it before it's gone - and nothing about it stays on our side after that.
The app above them is where the parts an anonymous scan structurally can't do live.
Verify a domain once - a DNS record, a file at a known path or a meta tag, once per apex domain, subdomains included - and every scan against it counts as evidence worth showing to an auditor, which an anonymous result never can be. Every scan is also kept rather than read once and discarded: a series that shows how your exposure actually moved, which is the only form that answers the question a manager or an auditor actually asks: is this getting better? That is a subject of its own.
How the five fit together
Each scanner produces a score from 0 to 100 and a grade from A+ to F. Together they combine into one composite grade, weighted by how much of a typical estate's risk each layer carries. Domain credibility is the one the app adds beyond the four free tools above:
| Layer | Weight |
|---|---|
| HTTP | 30% |
| TLS | 20% |
| Ports | 20% |
| DNS | 20% |
| Domain credibility | 10% |
The composite is the number you put in a monthly report. The individual grades are where the work is. The docs explain what each scan type covers.
Built-in Discovery finds the inventory the five scans above run against - unscored, but it matters more than that sounds, because where an asset list comes from decides whether any of the results are worth reading.
One scan tells you about one afternoon
Security posture degrades quietly. A header disappears in a deployment. A certificate approaches expiry. A protocol is re-enabled to fix a compatibility complaint and left that way. A DNS record outlives the service it pointed at.
None of it is announced and none of it breaks anything visibly, which is why a one-off assessment ages badly and a scheduled one does not. Scans can run weekly, daily or hourly depending on plan, and a grade that drops between two of them becomes a message rather than something you have to go and look for.
For teams that need this across servers and endpoints rather than only from outside, that is a separate capability.
Security scanner use cases for teams and MSSPs
Start with one domain
Verify it, run Discovery, and see what comes back before planning anything wider.
Every scan type is included on every plan, including the free one.