← All tools

Deep Scan: Attack Surface & Exposure Audit

A heavier audit than the free domain scan — checks TLS protocol depth (does the server still accept deprecated TLS 1.0/1.1?), cookie and CSP hygiene, mixed content, known-vulnerable JS library versions, and sweeps for accidentally exposed files: .git directories, .env files, database backups, credentials, and leftover debug endpoints — plus a scan for leaked API keys, tokens and unusual PII exposure in whatever's publicly served. Runs ~35-45 requests against the target, so it takes noticeably longer than the free scan (typically 10-30 seconds).

Only scan a domain you own or are authorized to test. Every check here is passive/non-intrusive (it reads what's already publicly served — it never attempts to log in, inject payloads, or exploit anything), but running it against someone else's site without permission is still not okay.

Last updated: September 9, 2026

How to use this tool

1. Enter a domain or full URL you own or are authorized to test, then click Run Deep Scan.
2. Wait 10-30 seconds while it runs roughly 35-45 passive checks against the target.
3. Fix Critical findings first — exposed .git/.env files, leaked secrets, and deprecated TLS versions are the highest-value fixes.
4. Re-run after each fix to confirm it actually closed the finding.

Use it for a pre-launch check on a new site, a periodic health check on one you already run, or before handing a domain over to a client — anywhere a quick attack-surface sanity check beats finding out from an actual incident.