Know what is exposed.
Bring domains, public services and overlooked endpoints into an inventory your team can review.
New: free PHP2Shell check for your websiteEXTERNAL ATTACK SURFACE MANAGEMENT
See your exposure. Know what to fix.
Website security scanning and external attack surface management for your public-facing assets. Review exposed services, security findings and supporting evidence, then plan your next action.
Explore an illustrative report without an account, or start with the Free plan.
THE PLATFORM
Your external perimeter
24Discovered assets
03Priority findings
01 — 03Example environment · acme.example
BUILT AROUND YOUR SECURITY WORKFLOW
◈Security teams⌘IT operations◎Managed service providers
FROM EXPOSURE TO ACTION
A clearer perimeter. A shorter to-do list.
Connect the outside view of your infrastructure to the decisions your team makes every day.
See the finding in context.
Review severity, affected assets and supporting evidence together, without losing the reason it matters.
Make the next step clear.
Turn a technical observation into an actionable remediation task with an owner and a clear outcome.
ILLUSTRATIVE REPORTSMH-001
An exposed admin service needs attention.
Critical- Affected asset
admin.acme.example- Observed evidence
- Management sign-in page accessible over HTTPS.
- Recommended next step
- Confirm ownership and restrict access to the management endpoint.
SHOW THE WORK
The evidence belongs next to the finding.
A score starts the conversation. The asset, observation and recommended action make it useful. Open the sample report to explore the full structure.
- Asset-level context
- Clear remediation guidance
- A report your team can review
HOW IT FITS
One domain. A more informed team.
- 01
Define your scope
Identify the domains and infrastructure your organization owns.
- 02
Review your exposure
Explore findings with their evidence and affected assets.
- 03
Decide what comes next
Prioritize remediation and agree on the monitoring coverage you need.
Frequently asked questions.
Can I see an example before signing up?
Yes. The sample report is available without an account. It uses fictional assets and findings to show the evidence and recommended actions you can review in a report; it is not a scan of your systems.
How do I scan my own assets?
Create an account, add an asset and complete the required ownership verification and scan authorization in your workspace. You can then start an available scan within your plan limits. Only scan systems you own or have explicit permission to test.
How do plans and billing work?
The pricing page lists Free, Pro and Enterprise plans and their included limits. The same EUR base prices apply in Türkiye and the EU; applicable taxes are calculated and added at checkout. Stripe creates invoices for paid purchases, available through your workspace or its secure billing page. Compare monthly or yearly billing, and manage or cancel a paid subscription from your workspace.
What does a ScanMyHost assessment cover?
ScanMyHost assesses the authorized internet-facing scope shown in your workspace. Depending on the selected assessment, it can review exposed services, TLS and web configuration, application signals and evidence-backed known exposures. The report states which checks completed, failed or were not applicable.
Is this a penetration test or a guarantee that every issue will be found?
No. ScanMyHost provides a bounded external security assessment and remediation guidance. It is not a certification, a replacement for a scoped penetration test or a guarantee that every vulnerability will be found. Incomplete or failed coverage is shown instead of being presented as a clean result.
Is AI Deep Validation available?
No. AI Deep Validation is not available in the current customer release, and ScanMyHost does not sell the current service as an AI red team. It will remain unavailable until its controlled security and release checks are complete.
What happens when I cancel a paid subscription?
You can manage or cancel a paid subscription from the secure billing portal in your workspace. A cancellation scheduled for period end keeps the paid plan active until the end of the current billing period and prevents the next renewal. Check the confirmation shown in the portal.
Can I permanently delete my account and data?
Yes. Account settings provide a two-step deletion flow secured by a 10-minute email code. Confirmation permanently removes the workspace and linked product data, cancels active billing and signs you out. A pseudonymous deletion receipt may be retained for up to 30 days, while Stripe may retain transaction records where law requires it.
SCANMYHOST / NORDTRACER
Explore sample reportMake your outside view actionable.
Start with the report. See whether the output fits the way your team works.