I Built a Passive Web Security & DNS Posture Scanner (with a Live REST API & Telegram Bot)

When you ship web apps frequently, security posture tends to drift silently. A missing Strict-Transport-Security header, a permissive SPF record exceeding 10 DNS lookups, or an forgotten CNAME pointing to a deleted cloud instance usually stays invisible until someone flags it.

Invasive vulnerability scanners require strict authorization and can stress production servers. I wanted something fast, read-only, and actionable that works just like an external browser.

So I built SurfaceScan
.

What a Passive Scan Checks

Enter any domain at surfacescan.uk
(no signup required) and it runs external checks in a few seconds:

Cryptography & Transport: SSL/TLS certificate chain, TLS 1.2/1.3, expiration warnings, and HTTP → HTTPS redirects
HTTP Security Headers: HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP
Sessions & Integrity: HttpOnly/Secure/SameSite cookie flags, permissive CORS wildcards, mixed content, and third-party script Subresource Integrity (SRI)
Email & DNS Trust: SPF (including recursive DNS lookup counting), DKIM, DMARC, DNSSEC, and CAA
Attack Surface: Certificate Transparency subdomain discovery, dangling CNAME takeover detection, RDAP domain expiry, and exposed files (security.txt, robots.txt, leaked .git endpoints)
Actionable Fixes Across 10 Stacks

Every issue includes ready-to-use configuration snippets tailored to your stack:

Nginx · Apache · Caddy · Cloudflare · Vercel · Netlify · Next.js · Express · IIS · WordPress

Built-in Security Builders & Live REST API

Under surfacescan.uk/tools
, there are free client-side builders and a Live API Tester:

Content-Security-Policy (CSP) Builder
SPF & DMARC Builder (tracks the RFC 7208 10-DNS-lookup limit live)
RFC 9116 security.txt Generator
Public REST API & Live Tester

You can hit the scan API directly from your terminal or CI pipeline:

bash
curl "https://surfacescan.uk/api/scan?domain=example.com"

Or pass an optional X-API-Key (generated from your profile) for higher quotas:

bash
curl -H "X-API-Key: YOUR_API_KEY" "https://surfacescan.uk/api/scan?domain=example.com"

Compare two domains side-by-side:

bash
curl "https://surfacescan.uk/api/compare?a=example.com&b=stripe.com"
Scan Directly in Telegram

Need a quick check from your phone? Send any domain to @surfacescan_bot
on Telegram to get the grade, breakdown, and monitoring alerts in chat.

Pricing Model
Free: Instant web scans (no account needed), interactive policy tools, up to 3 watchlist domains, and a 30 req/min API key.
Pro ($5/month): Up to 50 monitored domains, automated email/Telegram/webhook drift alerts, and 120 req/min (10,000/day) API limits.

Give your production domain a quick check at surfacescan.uk
— feedback from fellow devs is always welcome!