Run a free Ghost Scan. See exactly what attackers find. Watch a simulated attack replay. Fix it with plain English guides.
Free · No account needed · Passive external checks only
AI and automated scanners can make mistakes — verify findings before you act.
A simulation of the reconnaissance a hacker runs on any business. Your Ghost Echo is personalized with your actual findings.
Ghost Echo Pro: your domain, your real findings, watermarked and shareable.
Type your domain and your free scan starts automatically. No account, no install, no setup.
Our scanner runs 15+ passive checks across SSL, email, headers, and exposure. Then we generate a Ghost Echo — the hacker's view of your business.
Get a Ghost Score, prioritized findings, and step-by-step fix guides written for non-technical owners.
We score your business across 5 attack categories. Each finding affects your score. Fix a finding, then re-scan to see your score update.
Start free. Upgrade when you see the value.
One-time scan, no card needed
Full protection + Ghost Echo
or
Multiple domains + team
Is this safe? Will it harm my website?
Active checks (port and web-configuration scanning) run only on domains whose owner has verified control via DNS, using rate-limited, non-destructive tools designed not to disrupt your site. Free scans are passive and external — they never touch your server.
Do I need to install anything?
Nothing. Enter your domain and we scan remotely from our infrastructure — no account or install needed.
What is Ghost Echo?
Ghost Echo is an animated terminal replay showing exactly what an attacker finds about your business in their first 5 minutes of reconnaissance. It's watermarked and shareable. During beta it's included for verified domain owners; at launch it's part of Pro Shield.
How accurate are the findings?
Every check is based on data an attacker can see from outside your network. Findings are generated automatically; we show our work so you (or your IT provider) can verify each one. Spot something off? Tell us — we fix scanner accuracy fast.
Can I scan a domain I don't own?
Yes — passive scanning works on any domain, and every scan requires you to confirm you're authorized to run it. Active scanning — port scans and deep vulnerability checks — only runs on domains you've verified you own.
Scanning is free — run yours above, no account needed. Paid plans aren't open for sale yet: we're finishing weekly automated rescans of your verified domains and email alerts when your score changes. Business will cover up to 5 domains; MSP up to 25. Tell us what you manage and we'll come to you first when it opens.