See what your domain quietly exposes
Enter your company domain for a free, passive snapshot of your external security surface. Every issue is scored by severity and fix effort, in plain language, with the fix, the same way we score findings in a full Secvura report.
We hold ourselves to this: see secvura.com’s own snapshotWhat the check looks at
The passive checks read only what anyone on the internet can already see, including the front-end code your site serves to browsers. When we detect a Supabase or Firebase backend, we also use the public config your app already ships to test, read-only, whether your data is readable without a login. We never sign in, never use a secret key, never read your actual data, and never write or store your results or any personal data. (If you choose to have the report emailed to you, we keep your email to send it; more in our privacy policy.)
Transport security
HTTPS enforcement, HSTS, and TLS certificate health.
Application headers
CSP, clickjacking protection, nosniff, referrer policy.
Session cookies
Whether session and auth cookies carry HttpOnly, Secure and SameSite.
Email security
SPF, DKIM, DMARC and MTA-STS: can attackers send email as you, or intercept mail to you?
DNS hygiene
CAA records and a signposted way to report vulnerabilities.
Information disclosure
Stack and version numbers leaking in your headers.
Exposed secrets
API keys or tokens (such as a Supabase service_role or Stripe secret key) left in the front-end code your site serves to browsers.
Database access
If we detect a Supabase or Firebase backend, we use the public config your app ships to test, read-only, whether any data is readable without a login.
What it can’t see, and why that matters
This is the outside view. The findings that most often cost companies real money live inside the application: broken access control, an ID you can change in a URL to read another customer’s data, injection, and authentication flaws. An automated external check can’t reach those. Finding them is what a hands-on Secvura security review is for.
Built on Supabase? One inside risk you can check for free right now: test which tables are readable without a login.
Prefer to start from one check? Each runs the same free Surface Check and jumps you straight to that result.
How your external surface compares
Every free Surface Check adds one anonymous grade to this distribution, no domain, no results, just the letter. Here is how that A-to-F grade tends to fall.
of the companies we’ve checked score below a B on basic external security hygiene.
Based on 274 companies checked
Most common grade: B
Each company counts once (its first-seen grade), so repeat checks don’t skew the picture. The Surface Score reflects external hygiene only, what your domain shows the internet, not your overall security.
The most common gaps we find
Across those 274 companies, the checks that fail most often:
- 89%have no MTA-STS policy, so inbound mail can be delivered without TLS
- 65%publish no security.txt, so there is no clear way to report a vulnerability
- 62%set no Referrer-Policy
- 55%have no Content-Security-Policy
- 46%are missing X-Content-Type-Options: nosniff
- 38%can be embedded in a hostile frame (clickjacking)
- 22%advertise their software and version in HTTP headers
- 20%do not send HSTS, so a first visit can be downgraded to plain HTTP
Percentages are of distinct companies, each counted once. External-surface checks only.
Surface Check FAQs
Is the Surface Check free?
Yes, completely free. There's no sign-up, no account, and no card required. Enter your domain and you get the result straight away.
Is it safe to run on my website?
Yes. It is read-only and it never signs in, never uses a secret key, and never writes or changes anything. The passive checks read only what your domain already shows the public internet: HTTP response headers, the TLS certificate, public DNS records, and the front-end code your site serves to browsers. When it detects a Supabase or Firebase backend, it also uses the public config your app already ships to every visitor to test, read-only, whether your data is readable without a login, without ever reading your actual data.
Do you store my domain or the results?
We don't store your results or any personal data. The snapshot is generated live each time and isn't saved, and opening a shared result link simply re-runs the same passive check. We do keep an anonymous tally of which domains are checked, and how often, to see which companies the tool is useful for: that's just the domain and a number, nothing about you. The only time we hold your email is if you choose to have the report emailed to you, or ask us to watch your domain, and even then it's one-click to stop, never sold, and our privacy policy explains it in full.
Can you keep an eye on my domain for changes?
Yes, optionally. When you have the report emailed to you, you can tick a box to have us watch your domain. It's automated: we re-check it about once a week and email you only when your Surface Score changes, such as a new issue appearing or a certificate nearing expiry. If nothing changes, you hear nothing. It's free, one click to stop, and we store only your email, the domain, and the list of issues found so we can tell what changed.
What does the check look at?
HTTPS enforcement and HSTS, TLS certificate health, security headers (CSP, clickjacking protection, nosniff, referrer policy), session-cookie flags, email security (SPF, DKIM, DMARC and MTA-STS), DNS hygiene (CAA and security.txt), whether your software and version leak in your HTTP headers, whether any API keys or secrets (such as a Supabase service_role or Stripe secret key) have leaked into the front-end code your site serves to browsers, and, when we detect a Supabase or Firebase backend, whether any of your data is readable without a login. Every issue is scored by severity and by how much effort it takes to fix.
Is this the same as a full security review?
No. This is the outside view only. The issues that most often cost companies money live inside the application (broken access control, an ID you can change in a URL to read another customer's data, injection, and authentication flaws), which an automated external check can't reach. A full Secvura security review is a hands-on assessment that finds those, at a fixed price of £1,200 with a report in one to two weeks.
How accurate is it, and can I act on it?
Every finding reflects something we actually observed on your domain, with a plain-language explanation and a concrete fix your team can follow. It's a genuine, if narrow, starting point. Where a check can't be conclusive from the outside, such as DKIM, which depends on a selector we can't always guess, we say so rather than raise a false alarm.