Each scanner is a well-known tool, run against your verified targets only. Some contact the host itself; the domain checks (lookalikes, subdomains, email) only query DNS and public sources.
Where each scanner runs
- On the domain's own target (
example.com): lookalike domains, subdomains, subdomain takeover and email security. They're about the domain as a whole, so they run once for it, not for each host. - On any host (
example.com,app.example.com, an IP address): the rest, which connect to the host. - Every day, on its own: Expiry watch, which isn't scheduled. See its section below for when it runs and where its findings appear.
To look at any domain's mail records before adding it, with no sign-up:
- The free email security checker runs the same checks as the email scanner, plus DKIM.
- The DMARC record builder and validator explains a DMARC record tag by tag and builds one to publish.
- The MTA-STS and TLS-RPT validator checks the record, the policy file and which mail servers it covers.
- The lookalike domain checker lists the first ten registered lookalikes, with when each was registered and whether it receives mail.
Schedules
On a target's Scans page, pick the scanners and how often each runs: weekly, daily or more often, as your plan allows. Each new schedule runs once right away (or as soon as the target is verified), then at a quiet time in your time zone, spread out so scans don't pile up. That first run is part of the schedule: it isn't a Scan now and doesn't count toward that allowance.
Under Schedules you can see every schedule, change its time or time zone, pause it, or remove it. A schedule whose run was skipped (for example because the plan doesn't allow it) says why.
| Plan | Most often a schedule can run |
|---|---|
| Free | Weekly |
| Pay-as-you-go | Daily |
| Enterprise | As agreed |
Scan now
Scan now, on a target's overview, runs one scanner or all of them right away, scheduled or not. It goes through the same checks as a scheduled run: the target must be verified, and the scanner must be on your plan. Only one run of each scanner on a target can be in progress at a time.
Scan now is part of paid plans: pay-as-you-go includes 10 runs a month per domain, and each one beyond costs $4. Owners, admins and analysts can run it.
Scanning an API with ZAP
ZAP finds pages by following links, so on a JSON API, which has none, it finds little. Give it the API's OpenAPI (or Swagger 2.0) definition under a target's Settings → API definition for ZAP, and each ZAP scan first requests every endpoint in it, with the definition's example values, then checks the answers along with the pages it crawls.
- Its URL: https, on the target's host, a subdomain of it or its parent domain (for
api.example.com, alsoexample.com/openapi.json). It's fetched for each scan, so the scan follows the API as it changes. When the target scans signed in, a definition on the target's own host is fetched with the session. - Upload the file: JSON or YAML, at most 1 MB. Upload it again when the API changes.
The definition must be one file: references within it (#/components/…) are expanded, but one to another file or URL makes the scan fail, since it isn't fetched.
The scan stays passive:
- Only the operations that read (GET and HEAD) are requested. POST, PUT, PATCH and DELETE operations are left out, since requesting them with example values could change your data.
- Requests go to the target itself, whatever servers the definition names, keeping their base path (such as
/v1). - Signed in, paths excluded for the test account are left out too (matched against the whole path, base path included), and every request carries the session.
If the definition can't be fetched or read, the ZAP scan fails and says why, rather than scanning less than you asked.
Scanners
Nmap
Which ports are open on the host and what software answers on each. (Nmap documentation)
- Open TCP ports on the default port set
- Service and version detection
- Ports open beyond your expected-ports baseline
- Plain HTTP that does not redirect to HTTPS
What it reaches: Connects to the host; no scripts beyond page titles.
Nikto
Web server checks for dangerous files, outdated software and misconfiguration. (Nikto documentation)
- Default, backup and sensitive files
- Outdated server software
- Missing or weak security headers
- Risky HTTP methods and server options
What it reaches: Many requests to the site; can take a while on large sites.
Nuclei
Community templates for known CVEs, exposed panels and files, and misconfigurations. (Nuclei documentation)
- Known CVEs in what the site runs
- Exposed admin panels, configs and backups
- Misconfigurations and default setups
- Technology, header, TLS and DNS details (Info)
What it reaches: Requests to the site from non-intrusive templates only: no DoS, fuzzing, brute force or out-of-band checks.
testssl.sh
How well the HTTPS port's TLS protects traffic. (testssl.sh documentation)
- Protocol versions and cipher strength
- Forward secrecy and server preferences
- Certificate validity and chain
- Known TLS flaws (Heartbleed, ROBOT and others)
What it reaches: TLS handshakes with the HTTPS port.
WhatWeb
The software behind the site, with versions that feed the CVE lookup. (WhatWeb documentation)
- Web server, language and framework
- CMS and JavaScript libraries
- Versions, matched against known CVEs
- Versions given away in the Server, X-Powered-By, X-AspNet-Version and X-AspNetMvc-Version headers and generator tags
What it reaches: One request per page, following redirects.
wafw00f
Whether a web application firewall sits in front of the site, and which. (wafw00f documentation)
- WAF or CDN protection in front of the site
- The product, when it can tell
What it reaches: A few requests to the site.
Subfinder
Subdomains that public sources know about, so you can see what else is exposed. (Subfinder documentation)
- Subdomains from certificate transparency and DNS datasets
- New subdomains as they appear
- One click to add a subdomain as a target
What it reaches: Public sources only; nothing is sent to your hosts.
Subdomain takeover
Subdomains that still point at a service you no longer use, which someone else could claim. (Subdomain takeover documentation)
- CNAME records to names that no longer exist
- Unclaimed pages on hosting services (GitHub Pages, Heroku, S3 and others)
- Azure and Elastic Beanstalk names free to register
What it reaches: Public sources for the subdomains, DNS lookups, and one request to each subdomain that points at another service; none to private addresses.
Secrets in JavaScript
API keys, tokens and other secrets shipped in the site's public JavaScript, where anyone can read them. (Secrets in JavaScript documentation)
- Scripts served from the site's own hosts, and their source maps
- 800+ kinds of keys (cloud, payment, email, maps, AI providers and more), found with TruffleHog
- Each value shown masked; keys are never tried against their provider
What it reaches: Requests to the site's pages and scripts, about the load of WhatWeb plus one request per script; no requests to anyone else.
Open cloud storage
Cloud storage (AWS S3, Azure Blob, Google Cloud Storage) your DNS points at, or named like your company, that lets anyone list its files. (Open cloud storage documentation)
- Buckets your subdomains point at (CNAMEs to S3, Azure Blob or Google Cloud Storage)
- Public buckets named like your company (acme, acme-backup, acme-assets…), reported as "check whether it's yours"
- Listing only: no file is ever downloaded
What it reaches: DNS lookups and anonymous requests to AWS, Azure and Google storage; nothing is sent to your hosts.
DNS hygiene
Whether the domain's DNS gives its hosts away, can be used to attack others, or lets any certificate authority issue for it. (DNS hygiene documentation)
- Zone transfers (AXFR) that hand out every record in the zone
- Nameservers that answer recursive queries for anyone (open resolvers)
- CAA records limiting which certificate authorities may issue
- Wildcard records that make every made-up subdomain resolve
- Nameservers that don't answer for the zone, or disagree on its version
What it reaches: DNS queries to the domain's nameservers, including one zone transfer request each; nothing is sent to your other hosts.
ssh-audit
Whether the SSH server's cryptography is current. (ssh-audit documentation)
- Weak key exchange, host key, cipher and MAC algorithms
- Server software and banner
- No SSH on port 22 is a clean result
What it reaches: One SSH handshake on port 22; no login, no connection flood.
checkdmarc
Whether others can send mail as your domain, and whether mail to it stays encrypted. (checkdmarc documentation)
- SPF and DMARC records and policies
- MTA-STS and SMTP TLS reporting
- DNSSEC
What it reaches: Public DNS, plus the MTA-STS policy file if one is published.
Blocklists
Whether the domain or its mail and web servers' addresses are on spam and abuse blocklists. (Blocklists documentation)
- The domain on domain blocklists
- Mail server (MX) addresses, and the sending addresses SPF names itself, on IP blocklists
- The website's addresses on the same lists
- Addresses shared by big providers (Google, Microsoft 365, SendGrid) told apart from your own, since their listings are the provider's to fix
- Each listing with the list's lookup and removal page
What it reaches: DNS lookups to the blocklists' servers; nothing is sent to your hosts.
dnstwist
Registered domains that look like yours and could be used for phishing. (dnstwist documentation)
- Typos, swapped letters, homoglyphs and other TLDs
- Which lookalikes can receive mail
- New lookalikes as they are registered, and changes to their registration
- A screenshot of each lookalike's website
- Unregistered lookalikes worth registering before someone else does
What it reaches: DNS and public registration (RDAP) lookups, and one visit to each lookalike's home page for its screenshot; nothing is sent to your hosts.
ZAP
A passive web application scan of the pages a crawler finds. (ZAP documentation)
- Content Security Policy, HSTS and other headers
- Cookie flags
- Information leaks and error disclosure
- Third-party scripts without integrity checks
- Source maps that give away the original JavaScript source
What it reaches: Crawls the site for up to 5 minutes, after the read-only endpoints of its API definition when it has one; no active (attack) scan.
Expiry watch
Whether the site's TLS certificate or the domain's registration is about to run out.
- TLS certificate expiry, from 30 days before
- Domain registration expiry, from 60 days before
- Domains on hold, in redemption, pending delete or no longer registered
- A published MTA-STS policy: valid, a max_age of a day or more, and its host's certificate
- DNSSEC signatures about to expire, within 2 days, or expired
- DNS records you added for us (MTA-STS, DMARC and TLS reports): a medium finding when one goes missing or changes, with weekly reminders
- For a domain that receives mail: an alert when its SPF, DMARC, TLS-RPT or MTA-STS record disappears or starts erroring
What it reaches: One TLS handshake with the host each day, one lookup of the domain in its registry's RDAP, two DNS-over-HTTPS queries to Cloudflare's resolver for its DNSSEC signatures, for a domain with MTA-STS, its policy file and policy host's certificate, and for a domain that receives mail, the DNS lookups of its email records.
When it runs: Runs every day on its own, on each verified target your plan scans. It is not scheduled and has no Scan now.
End of life
Whether the software the target runs is on a release that no longer gets fixes.
- Releases past their end of life, with the date security fixes ended
- Releases past active support that get security fixes only
- Distribution packages, held lower while the distribution itself is supported
- The releases still supported, to upgrade to
What it reaches: Nothing is sent to your hosts: it reads the versions your other scanners last saw, against release dates from endoflife.date.
When it runs: Runs every day on its own, on each verified target your plan scans. It is not scheduled and has no Scan now.