SecureSurface reviews the public security signals of any domain — email spoofing protection, browser security headers, TLS and software exposure — and gives you an A–F grade in seconds. Then shows you exactly how to fix every finding.
Score 84 / 100 · scanned just now
We read exactly what any browser or mail server already sees — no scanning tools, no probing, no login attempts.
Can someone send email pretending to be you? We check whether your domain publishes the records that stop phishing in your name.
Headers tell browsers how to protect your visitors from clickjacking, content injection and data leaks.
We confirm your certificate is valid and trusted, flag upcoming expiry, and detect obsolete protocols.
Version banners make it easy to match your stack against known vulnerabilities. We tell you what you're advertising.
No agents, no access requests, no change to your systems.
We perform a handful of ordinary public lookups — DNS records, one HTTPS page load and the TLS handshake.
See your A–F score and every finding we observed, ranked by severity, with a plain-language explanation.
Unlock exact DNS records, header values and server settings to apply — written for your stack, ready to hand to your team.
Every finding comes with the precise change to make, why it matters, and how to verify the fix. Hand it to your developer, your host or your IT provider as-is.
# Observed _dmarc.northwind-services.com TXT "v=DMARC1; p=none" # Recommended — publish at your DNS host Host: _dmarc Type: TXT Value: "v=DMARC1; p=quarantine; pct=100; rua=mailto:dmarc@northwind-services.com" # After 2–4 weeks of clean reports Value: "v=DMARC1; p=reject; …"
Security outreach only works when it's honest. These rules are enforced in our code, not just our policy.
We only read public data. No port scans, no payloads, no login attempts — ever.
What we observe about your domain is shared with you at no cost. You pay only for the remediation guide.
Every notice can be unsubscribed instantly, and any domain can join our do-not-contact list.
Reports state only what was measured. We never claim vulnerabilities we didn't observe.
No subscription. Scan as often as you like for free; pay once per report when you're ready to fix.
Your grade and every finding we observed.
Step-by-step fixes for every finding on one domain.
A full penetration test under a signed scope of work.
No hacking of any kind. We only read information your domain already publishes to everyone: DNS records, the headers returned when your home page loads, and your TLS certificate. It's the same data any visitor's browser or any mail server sees.
We review public security signals and send a one-time notice to a generic role address (like security@ or contact@) when we see room for improvement. The findings in that email are free. You can unsubscribe in one click, or add your domain to our do-not-contact list.
The free check tells you what we observed and your grade. The full report tells you exactly how to fix it — the precise records, header values and settings — plus how to verify each fix.
It means your public surface is well configured. It does not test your application itself — things like injection flaws or access control can only be assessed by an authorized audit with your written permission.
Payments are processed securely by Stripe. We never see or store your card details. Your report is unlocked instantly and saved to your dashboard.
We store the scan results for your domain and, if you create an account, your email address. We don't sell data and we only contact role addresses, never named individuals.
Free, passive, and nothing to install.