Hey Product Hunt! I’m Huseyn, the maker of SurfaceScan (surfacescan.uk).

I built SurfaceScan because every time I shipped a web project, I wanted a fast sanity check to make sure nothing obvious was left open — no expiring TLS cert, no missing HSTS/CSP, no weak DMARC policy, and no accidentally exposed `/.git/HEAD` or `/.env` files. Existing security tools either looked like overwhelming enterprise dashboards or gave vague warnings without telling you what line to add to your Nginx, Cloudflare, or Next.js config.

So I built a calm, passive security auditor that checks a domain in seconds with zero sign-up:

10+ Passive Checks (A+ to F Grade): TLS/SSL chain & cipher suite, HTTPS redirect, HTTP security headers (HSTS, CSP, XFO, COOP, Referrer-Policy, Permissions-Policy), HTTP/3 & IPv6 readiness, DNS email auth (SPF, DMARC, DKIM, CAA, DNSSEC), Cookie & CORS flags, SRI/mixed content, subdomain discovery, and exposed secret paths.

Copy-Paste Server Fixes: Specific remediation configs for 10 stacks — Nginx, Apache, Caddy, Cloudflare, Vercel, Netlify, Next.js, Express, IIS, and WordPress.

Verifiable Domain Security Certificates: Prove domain ownership via DNS TXT and issue a public verification page (`surfacescan.uk/cert/...`), a downloadable PDF certificate, a 1-click LinkedIn credential, and a live SVG seal badge that auto-updates if your score drops.

Everywhere You Work: Bulk domain scanner, REST API, Microsoft Edge Add-on, and a GitHub Marketplace Action (`HuseynDeveloper/surfacescan-action@v1`) with SARIF support.

Everything core is free to scan without creating an account, and Pro ($5/mo) unlocks continuous monitoring alerts, full API/PDF workflows, and 1-year `Pro Certified (90+)` domain monitoring.

I’d love your honest feedback:

1. Run `surfacescan.uk` on your own domain — did any check catch something unexpected, or feel unclear?

2. Which hosting platforms or security checks should I add next to the remediation generator?

Thanks for checking it out!