I Built a Passive Web Security & DNS Posture Scanner (with a Live REST API & Telegram Bot)

When you ship web apps frequently, security posture tends to drift silently. A missing Strict-Transport-Security header, a permissive SPF record exceeding 10 DNS lookups, or an forgotten CNAME pointing to a deleted cloud instance usually stays invisible until someone flags it.

Invasive vulnerability scanners require strict authorization and can stress production servers. I wanted something fast, read-only, and actionable that works just like an external browser. So I built SurfaceScan.

What a Passive Scan Checks

Enter any domain at surfacescan.uk (no signup required) and it runs external checks in a few seconds:

• Cryptography & Transport: SSL/TLS certificate chain, TLS 1.2/1.3, expiration warnings, and HTTP → HTTPS redirects
• HTTP Security Headers: HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP
• Sessions & Integrity: HttpOnly/Secure/SameSite cookie flags, permissive CORS wildcards, mixed content, and third-party script Subresource Integrity (SRI)
• Email & DNS Trust: SPF (including recursive DNS lookup counting), DKIM, DMARC, DNSSEC, and CAA
• Attack Surface: Certificate Transparency subdomain discovery, dangling CNAME takeover detection, RDAP domain expiry, and exposed files (security.txt, robots.txt, leaked .git endpoints)

Actionable Fixes Across 10 Stacks

Every issue includes ready-to-use configuration snippets tailored to your stack: Nginx · Apache · Caddy · Cloudflare · Vercel · Netlify · Next.js · Express · IIS · WordPress

Built-in Security Builders & Live REST API

Under surfacescan.uk/tools, there are free client-side builders and a Live API Tester:

• Content-Security-Policy (CSP) Builder
• SPF & DMARC Builder (tracks the RFC 7208 10-DNS-lookup limit live)
• RFC 9116 security.txt Generator

Public REST API & Live Tester

You can hit the scan API directly from your terminal or CI pipeline:

curl "https://surfacescan.uk/api/scan?domain=example.com"

Or pass an optional X-API-Key (generated from your profile) for higher quotas:

curl -H "X-API-Key: YOUR_API_KEY" "https://surfacescan.uk/api/scan?domain=example.com"

Compare two domains side-by-side:

curl "https://surfacescan.uk/api/compare?a=example.com&b=stripe.com"

Scan Directly in Telegram

Need a quick check from your phone? Send any domain to @surfacescan_bot on Telegram to get the grade, breakdown, and monitoring alerts in chat.

Pricing Model

Free: Instant web scans (no account needed), interactive policy tools, up to 3 watchlist domains, and a 30 req/min API key.

Pro ($5/month): Up to 50 monitored domains, automated email/Telegram/webhook drift alerts, and 120 req/min (10,000/day) API limits.

Give your production domain a quick check at surfacescan.uk - feedback from fellow devs is always welcome!