When you ship web apps frequently, security posture tends to drift silently. A missing Strict-Transport-Security header, a permissive SPF record exceeding 10 DNS lookups, or an forgotten CNAME pointing to a deleted cloud instance usually stays invisible until someone flags it.

Invasive vulnerability scanners require strict authorization and can stress production servers. I wanted something fast, read-only, and actionable that works just like an external browser.

So I built SurfaceScan

.

What a Passive Scan Checks

Enter any domain at surfacescan.uk

(no signup required) and it runs external checks in a few seconds:

Cryptography & Transport: SSL/TLS certificate chain, TLS 1.2/1.3, expiration warnings, and HTTP → HTTPS redirects

HTTP Security Headers: HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP

Sessions & Integrity: HttpOnly/Secure/SameSite cookie flags, permissive CORS wildcards, mixed content, and third-party script Subresource Integrity (SRI)

Email &…