Run a free Ghost Scan. See exactly what attackers find. Watch a simulated attack replay. Fix it with plain English guides.
Free · No account needed · Passive external checks only
AI and automated scanners can make mistakes — verify findings before you act.
A simulation of the reconnaissance a hacker runs on any business. Your Ghost Echo is personalized with your actual findings.
Ghost Echo Pro: your domain, your real findings, shareable with a client through a private link.
Type your domain and your free scan starts automatically. No account, no install, no setup.
Our scanner runs 15+ passive checks across SSL, email, headers, and exposure. Then we generate a Ghost Echo — the hacker's view of your business.
Get a Ghost Score, prioritized findings, and step-by-step fix guides written for non-technical owners.
We score your business across 5 attack categories. Each finding affects your score. Fix a finding, then re-scan to see your score update.
Start free. Upgrade when you see the value.
One-time scan, no card needed
Full protection + Ghost Echo
Multiple domains + team
Is this safe? Will it harm my website?
Free scans are passive: we read public DNS, certificate and WHOIS records and make a few ordinary web requests to your site (a secure connection, the home page and robots.txt), the same as any visitor's browser. No port scanning, no attack probes. Active checks (a port scan of common ports and web-configuration checks) run only when the account requesting the scan has verified control of the domain via DNS, at most once per domain every 24 hours. They are paced to avoid putting load on your site, and they detect issues without exploiting them.
Do I need to install anything?
Nothing. Enter your domain and we scan remotely from our infrastructure — no account or install needed.
What is Ghost Echo?
Ghost Echo is an animated terminal replay showing exactly what an attacker finds about your business in their first 5 minutes of reconnaissance. Verified owners can share it with a client through a private link. During beta it's included for verified domain owners; at launch it's part of Pro Shield.
How accurate are the findings?
Every check is based on data an attacker can see from outside your network. Findings are generated automatically; we show our work so you (or your IT provider) can verify each one. Spot something off? Tell us — we fix scanner accuracy fast.
Can I scan a domain I don't own?
Yes — passive scanning works on any domain, and every scan requires you to confirm you're authorized to run it. Active scanning — port scans and deep vulnerability checks — only runs on domains you've verified you own.
Scanning is free — run yours above, no account needed. Paid plans aren't open for sale yet: we're finishing weekly automated rescans of your verified domains and email alerts when your score changes. Business will cover up to 5 domains; MSP up to 25. Tell us what you manage and we'll come to you first when it opens.