HFiMW

Your website, from the outside

How fucked is my website?

See what your website exposes to the internet.

Free website scan
Enter a hostname. Your website, from the outside.

Be first to scan.

A private list. One launch email when free scans open.

HF Scan 01 Example View Not online yet
example.invalid
  • 1Alert
  • 9Watch
  • 5Observed

15 records

Records DNS

  • No DNSSEC signatures observedWatch
    Observed
    Answers for the zone carried no RRSIG records.
    Evidence
    DNSKEY and DS lookups returned empty answers.
    Confidence
    High that signatures were absent at the time of the lookup. This says nothing about whether anyone is currently spoofing answers.
    Action
    Consider enabling DNSSEC at the registrar and DNS host, then verify with a validating resolver before relying on it.
  • Zone transfer refusedObserved
    Observed
    AXFR requests to the listed nameservers were refused.
    Evidence
    Both nameservers answered REFUSED.
    Confidence
    High for the two nameservers tested.
    Action
    None needed.
  • Wildcard answersWatch
    Observed
    A made-up label under the zone resolved to the same address as the apex.
    Evidence
    random-label.example.invalid returned an A record.
    Confidence
    Medium - wildcards are often intentional; a single probe cannot tell.
    Action
    Confirm the wildcard is intended. It widens what certificates and virtual hosts have to cover.

Records TLS

  • Certificate chain validatesObserved
    Observed
    The served chain validated against a public trust store.
    Evidence
    Leaf covers the hostname; expiry 41 days out.
    Confidence
    High for this handshake. Renewal automation is not observable from outside.
    Action
    None now. Confirm renewal is automated well before the expiry date.
  • TLS 1.0 still negotiableWatch
    Observed
    A handshake capped at TLS 1.0 completed.
    Evidence
    ClientHello with maximum version 1.0 was accepted.
    Confidence
    High that the protocol is offered. Whether any real client uses it is unknown from outside.
    Action
    Disable TLS 1.0 and 1.1 unless a known client needs them; test the change against your real clients first.
  • No HSTS header on this responseWatch
    Observed
    The HTTPS response for / had no Strict-Transport-Security header.
    Evidence
    Response header list for one request.
    Confidence
    High for this response; other paths or hosts may differ.
    Action
    If every subdomain already serves HTTPS, consider HSTS with a short max-age first and lengthen it once nothing breaks.

Records Headers

  • No Content-Security-Policy headerWatch
    Observed
    The HTTPS response for / carried no Content-Security-Policy header.
    Evidence
    Response header list for one request.
    Confidence
    The header was absent from this response. Its impact depends on the page and other controls.
    Action
    If pages render user-influenced content, start with a report-only policy, review what it reports, then decide whether to enforce.
  • Server header names a versionWatch
    Observed
    The response advertised a server product and version string.
    Evidence
    Server: nginx/1.18.0.
    Confidence
    High that the string was sent; medium that it is accurate - banners can be stale, backported or deliberately misleading.
    Action
    Trim banner detail if your platform allows. Patch cadence matters more than the banner itself.
  • No framing restriction observedWatch
    Observed
    Neither X-Frame-Options nor a CSP frame-ancestors directive was present on this response.
    Evidence
    Response header list for one request.
    Confidence
    High that both were absent. Whether that matters depends on whether any page carries state worth tricking a visitor into clicking.
    Action
    If pages should not be embedded elsewhere, add frame-ancestors (or X-Frame-Options) after checking for legitimate embeds.

Records Ports

  • 22, 80 and 443 answerObserved
    Observed
    TCP connections completed on 22, 80 and 443.
    Evidence
    Connect-only probes; no authentication attempted.
    Confidence
    High. Usual for a web host with SSH.
    Action
    Confirm SSH is meant to be public. Key-only authentication and rate limiting are the common mitigations.
  • 3306 accepts connections from the internetAlert
    Observed
    A TCP connection to 3306 completed and a database greeting was returned.
    Evidence
    MySQL-style greeting banner. No login was attempted.
    Confidence
    High that the port answers publicly. Unknown whether credentials or host rules limit who can use it.
    Action
    Restrict the port to private networks or specific addresses unless there is a documented reason, then re-check from outside.
  • 8080 serves a login formWatch
    Observed
    An HTTP service on 8080 returned a page containing a login form.
    Evidence
    HTTP 200 with a password field. Nothing was submitted.
    Confidence
    Medium that it is an administrative surface; the form alone does not say what is behind it.
    Action
    Confirm its purpose. If it is administrative, limit it by network or put it behind a VPN.

Records Mail

  • SPF record presentObserved
    Observed
    A single SPF record lists permitted senders with a soft-fail default.
    Evidence
    v=spf1 … ~all.
    Confidence
    High.
    Action
    After confirming every legitimate sender is listed, consider -all.
  • DMARC policy is noneWatch
    Observed
    A DMARC record publishes a monitoring policy.
    Evidence
    v=DMARC1; p=none; rua=….
    Confidence
    High.
    Action
    Review aggregate reports and legitimate senders before changing the policy.
  • No MX recordObserved
    Observed
    The MX lookup returned no records.
    Evidence
    Empty MX answer.
    Confidence
    High for this DNS response; absent MX records alone do not prove mail cannot be received.
    Action
    If the domain never sends mail either, a null MX and v=spf1 -all make that explicit.
-Not submitted

Not online yet.

Join the private list below and we’ll email you when free scans open.

Public Limits

A read is not an attack.

Public information. Bounded requests. No sign-ins or exploitation.

Within scope

  • Public DNS and registration records passive
  • TLS certificate and protocol offer bounded handshakes
  • HTTP response headers and redirects a page load
  • Services that answer on common ports bounded requests
  • Mail authentication records SPF · DKIM · DMARC

Never

  • Signing in or guessing credentials
  • Exploiting anything found
  • Volumes that resemble an attack
  • Accessing authenticated or private content
  • Silent re-scans or retained host lists

They’re already looking.
See what they see.

Free scan Public Limits