Free · authorised domains only

External Security Check

Your exposed surface, mapped to the controls it touches. In minutes.

This grades your external surface, not your whole control set. Not a security or compliance pass.

A sample of what you'll get

Medium

Browsers can be tricked onto an insecure connection to your site.

A.8.24Touches A.8.24 (Use of cryptography): without HSTS, encryption in transit isn't enforced, so the first request can happen in the clear.

What an attacker could do: On shared or hostile Wi-Fi, an attacker intercepts a visitor's first plain-HTTP request and keeps them on an unencrypted connection, reading or rewriting the session before HTTPS ever engages.

FixQuick

Add a Strict-Transport-Security response header with a long max-age so browsers refuse HTTP for your domain. Confirm every subdomain is HTTPS-ready before adding includeSubDomains.

nginx

# nginx: serve on HTTPS responses only
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;

Also touches

E8-4app hardeningA.5.14information transferCC6.7data in transitCC6.1access and encryption

Raw evidence from the scan

example.com responded to https:// without a Strict-Transport-Security header, so a browser's first request can still be made over plain HTTP.

Add the Strict-Transport-Security header at the edge for every HTTPS response.

probe: sample:missing-hsts

What an external check can't see

This check reads what is reachable from the public internet. By design it cannot see the code-level holes inside your app, which is the honest reason it is a check and not a pentest.

Code-level bugs

Injection and cross-site scripting only surface when the application runs a request, not when a scanner reads its front door.

Broken authentication and access control

Whether a user can reach another tenant's data, or escalate their own role, is logic an external probe never exercises.

Exposed data behind a login

The real records live inside the authenticated app, where an unauthenticated scan cannot and must not go.

Hardcoded secrets in the application

Keys and credentials baked into server-side code are invisible from outside until someone with access looks.

What the External Security Check does

The check runs external probes against a domain you control, HTTP security headers, TLS configuration, DNS and email authentication, and attack-surface discovery, then maps every finding to the specific Essential Eight, ISO 27001 and SOC 2 control it touches. Every control code comes with a plain-English consequence, so you can act on it without a security team. It grades the external surface only, and it is scrupulous about what recon cannot see.

Frequently asked questions

Is this a full ISO 27001 or SOC 2 assessment?

No. It maps your external surface to the specific controls each finding touches. Most controls, endpoint, identity and backup controls, cannot be seen from outside at all, so the check is explicit about that boundary rather than pretending to grade them.

Do I need a work email to run the check?

No. You get the external-surface grade and your top findings from just the domain, once you confirm you are authorised to assess it. A work email on the same domain is only needed to unlock the full report, which is a light-touch authorisation check; free mailbox providers are not accepted.

Is it free?

Yes, the check is free with no account required. For the evidence your auditor accepts, reproduction steps and a proof-hash chain of custody signed by a certified security professional, request a full CyberOrbit assessment.

Recon sees the front door; a pentest walks the building.

A pentest walks the building and produces the evidence your auditor accepts: reproduction steps and a proof-hash chain of custody, signed by a certified security professional.

Get a pentest