Shipping a web app is exciting — until you remember all the small security checks you still need to verify before sharing the link publicly:
Is the SSL/TLS chain valid and redirecting properly?
Are Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, and Permissions-Policy actually set?
Are SPF, DKIM, and DMARC configured so your domain isn't easily spoofed?
Is DNSSEC enabled, and did any sensitive files (.env, .git, backup paths) accidentally stay exposed?
Usually, checking all of this means opening five separate tabs and then spending another 20 minutes searching for the exact Nginx or Cloudflare snippet to fix what failed.
That’s why I built SurfaceScan
.
What SurfaceScan Does in One Scan
Instant Passive Security Grade (A+ to F)
Enter any domain and get a clean breakdown across transport security, HTTP headers, DNS & email protection, and exposed attack surface — with zero agent installation and zero setup.
Copy-Paste Remediation for 10 Platforms
Instead of vague warnings, every failed check gives you ready-to-use configuration snippets for Nginx, Apache, Cloudflare, Caddy, Vercel, Netlify, Next.js, Express, and more.
Verified Security Certificates & Trust Badges
Domain owners can verify ownership via a standard DNS TXT record to unlock a public, verifiable security certificate page, a downloadable PDF certificate, and a live embeddable SVG badge.
(You can see a live example here: SS-2026-7953239C
)
CI/CD & Browser Support
GitHub Actions: Automate domain posture checks directly in your workflow with SurfaceScan Domain Audit
.
Microsoft Edge: Inspect any site straight from your toolbar with the SurfaceScan Edge Add-on
.
Live on Product Hunt Today
SurfaceScan also just launched on Product Hunt! 🎉
If you build or maintain websites, try scanning one of your domains and let me know what score you got or what checks you’d like added next.
Try a free scan: surfacescan.uk
Check out the launch on Product Hunt: SurfaceScan on Product Hunt
Top comments (0)