Security scanners
Four scanners for the four layers an outsider can reach. Each answers a different question, each produces a grade from A+ to F, and each keeps what it finds so the next scan has something to be compared against.
Free security scanners for TLS, ports, HTTP and DNS
Online port scanner
What is this estate willing to talk to a stranger about? Open ports with the service and version behind each one, matched against known CVEs. Powered by Nmap.
SSL/TLS checker
Is the encryption sound, and when does the certificate expire? Protocol versions, cipher suites, certificate chain and validity dates. Powered by testssl.sh.
HTTP security checker
Is the web application configured defensively? Security headers, the technologies the server reveals, and known web weaknesses. Powered by OWASP ZAP.
DNS security checker
Can anyone send mail that looks like it came from you? SPF, DKIM and DMARC, DNSSEC, and the records themselves.
What makes these different from the dozens of free scanners
Most online scanners will check any address you type. That is convenient, and it is also why their output is difficult to use for anything: a result about infrastructure nobody proved they own is a reconnaissance report, not evidence.
Two things are different here.
We check that the domain is yours before we scan it.
A DNS record, a file at a known path or a meta tag - one of the three, once per domain, and verifying an apex domain covers its subdomains. It is a step other tools skip, and it is the reason a report from here is worth showing to an auditor.
We keep the result.
A single scan is a snapshot of one afternoon. A series is a record of how your exposure actually moved, which is the only form in which any of this answers the question a manager or an auditor asks: is this getting better? That is a subject of its own.
How the four fit together
Each scanner produces a score from 0 to 100 and a grade from A+ to F. Together they combine into one composite grade, weighted by how much of a typical estate's risk each layer carries:
| Layer | Weight |
|---|---|
| HTTP | 30% |
| TLS | 20% |
| Ports | 20% |
| DNS | 20% |
| Domain credibility | 10% |
The composite is the number you put in a monthly report. The individual grades are where the work is.
A fifth scan, Discovery, is not scored. It builds the inventory the other four run against - which matters more than it sounds, because where an asset list comes from decides whether any of the results are worth reading.
One scan tells you about one afternoon
Security posture degrades quietly. A header disappears in a deployment. A certificate approaches expiry. A protocol is re-enabled to fix a compatibility complaint and left that way. A DNS record outlives the service it pointed at.
None of it is announced and none of it breaks anything visibly, which is why a one-off assessment ages badly and a scheduled one does not. Scans can run weekly, daily or hourly depending on plan, and a grade that drops between two of them becomes a message rather than something you have to go and look for.
For teams that need this across servers and endpoints rather than only from outside, that is a separate capability.
Security scanner use cases for teams and MSSPs
Start with one domain
Verify it, run Discovery, and see what comes back before planning anything wider.
Every scan type is included on every plan, including the free one.