Domain Security Test for your domain
Find out what your security tools might be missing. We test your domain from the outside, read-only, with no login and no payloads. A person checks every finding before it enters your written report.
What the test covers
The test looks at the publicly accessible attack surface of one domain:
- DNS and the records around it, including CAA.
- TLS and the certificate.
- E-mail protection with SPF, DKIM and DMARC.
- Security headers of your website.
How it works
You enter your domain and your work e-mail address and confirm that you own the domain or may test it. A researcher reviews your request before testing begins and replies within one business day. The check runs once, read-only and from a European IP address. It makes no changes to your systems.
What you receive
A short written report with our findings, likely attack scenarios, potential financial impact and recommended next steps. Each finding carries a CVSS severity. An exportable security intelligence graph connects the findings.
The test is an initial external assessment. It does not replace a source-code review and does not guarantee that your application is secure.
Evidence from audited software
The public ledger lists 387+ audited apps and 262+ critical findings. These full reports show how we document what we find:
- SAP: A Chinese push SDK in a field-service app, and Firebase keys hardcoded across five apps.
- Nike: Development and production push credentials hardcoded in the shipped build.
- Strava: A hardcoded key and a security configuration that protects nothing.
- Revolut: The largest third-party SDK in the series and what it sends to a US company.
Every other investigation is in the full evidence ledger.
Test your domain
Enter your domain below. A researcher reviews your request and replies within one business day.
After the test, the Access page shows what a full examination covers and costs.
Plans and prices are on Access, the agents behind every review on The Squad and the frameworks we measure against on Standards.
Put your domain to the test. Submit it for an initial external security assessment of your publicly accessible attack surface.
No login, no payloads and no changes to your systems.
A researcher reviews your request before testing begins and responds within one business day. You'll receive a short written report covering our findings, likely attack scenarios, potential financial impact and recommended next steps, alongside an exportable security intelligence graph connecting the findings.
Questions about the Domain Security Test
Do you change anything on our systems?
The test is read-only. It uses no login and no payloads.
Who sees my request?
A researcher reviews every request before testing begins.
How often do you test my domain?
Once. A one-word reply at any time is enough to stop, and we never check the domain again.
Is this a penetration test?
The test is an initial external assessment of the public attack surface. A source-code review goes further and is part of the full audits on the Access page.
Related pages
More on the pages App Security Audit, GDPR App Audit, NIS2 for Software Vendors, Tracker & SDK Check, AI App Privacy Audit, Outsourced SOC, Compliance Automation, Penetration Testing, API Security Testing, Cloud Security Assessment and Secure Code Review.
