ThreatLens checks certificates, security headers, cookies, DNS and email settings from the outside, then gives you a score and the exact fix for every finding.
client-site.example
Score 74 / 100 · 6 findings
HTTP does not redirect to HTTPS
Visitors stay on an unencrypted connection
No Content-Security-Policy
Scripts and resources are not restricted
No DMARC record
Anyone can send mail as this domain
Cookies readable by JavaScript
session_id has no HttpOnly flag
Illustrative preview. Real reports show your own scan.
What we check
Certificate validity and expiry, hostname match, chain, key strength, and whether obsolete protocols like TLS 1.0 are still accepted.
HSTS, Content-Security-Policy, clickjacking protection, nosniff, Referrer-Policy and Permissions-Policy, plus headers that leak versions.
Secure, HttpOnly and SameSite on every cookie the site sets, with session and login cookies judged more strictly.
CAA and name server setup, HTTP to HTTPS redirects and mixed content, so nothing is served in the clear by accident.
SPF, DKIM, DMARC and MTA-STS: the records that stop other people sending mail as your domain.
What the site reveals about its stack, and flags for libraries with known vulnerabilities such as old jQuery.
How it works
Type the address. We only accept public domain names, never IPs or internal hosts.
A separate worker loads the site, opens a TLS connection and reads public DNS, just like a browser or a mail server would.
Every finding has a severity, the evidence we saw and the exact change that fixes it. The score goes up as you fix things.
Roadmap
SSL, TLS, DNS, headers, cookies, email security, technology detection.
OWASP ZAP and scoped Nuclei checks, only for domains you have verified.
Evidence, remediation advice and professional PDF reports.
Organisations, subscriptions, scan credits and history.
Scheduled scans, change detection and white-label reports.
An external security audit platform. You give it a website address and it reports what a stranger on the internet can see and abuse: weak certificates, missing security headers, loose cookies, and DNS or email settings that let others impersonate you.
The checks in this version are passive: they load the home page, open a TLS connection and read public DNS records, the same things a browser or a mail server does. Anything more active, like vulnerability scanning, will only run on domains whose ownership you have proved.
No, and no external scan does. It finds misconfiguration and exposure that is visible from outside. It is a strong first pass and a good way to track improvement, not a replacement for a penetration test.
Every scan starts at 100 and loses points for each finding: critical 25, high 12, medium 6, low 2, informational 0. The score maps to a grade from A to F so you can see progress after every fix.
Agencies, freelancers and in-house teams who look after websites and want an objective, repeatable security check to show clients, with fixes they can hand to a developer.
Run your first scan and see where your site stands. We can also set ThreatLens up for your agency or team.