Free
Basic security checks for one domain.
$0/month
AUD
- 1 domain
- 3 quick scans + 1 standard scan per month
- Quick and standard scans
- Weekly monitoring (standard), included free
Already public
The internet already sees what you might not.
EightScope shows you that picture. Your website, your email, and everything publicly tied to your company.
- No credit card required
- Domain verification required
- Non-destructive external checks
OverviewDemonstration data
sample-company.example
VerifiedFull scanCompleted 18 minutes agoDemonstration dataView report
Security score
85/100
A+3 since previous scan
050100
Severity summary
0
Critical
0
High
4
Medium
8
Low
51
Passed
Open findings
4 shown
| Finding | Asset | Severity | Status |
|---|---|---|---|
| Clickjacking protection missing (X-Frame-Options / frame-ancestors) | app.sample-company.example | medium | Open |
| Content Security Policy (CSP) missing | elements.sample-company.example | medium | Open |
| Cookie scoped too broadly | sample-company.example | medium | Accepted |
| MIME sniffing protection missing | elements.sample-company.example | low | Open |
Demonstration data from an anonymised sample scan.
8
attack surface areas
Website, DNS, email, TLS, subdomains, public services, cloud storage and registration
Scan coverage
Up to 26 modules
Choose the right level of external assessment.
- Quick7 modules
- Standard15 modules
- Full26 modules
Change tracking
See what appeared, changed or was resolved between scans.
Prioritised findings
Severity and confidence decide what you see first.
Attack surface
What is exposed beyond your website?
EightScope examines eight external areas connected to a verified domain: website, DNS, email, TLS, subdomains, public services, cloud storage and registration records.
See what we assessyour domain
Verified domain
Website
1 primary host
HTTP behaviour, security headers, cookies and publicly exposed web paths that visitors can reach from the internet.
DNS
12 records
Records, nameservers, dangling references and other externally visible DNS configuration that shapes how the domain is reached.
Email security
SPF · DKIM · DMARC
SPF, DKIM and DMARC configuration published in public DNS records, which affects spoofing and delivery risk.
TLS certificates
3 observed
Certificate validity, protocol support and hostname coverage for public HTTPS services connected to the domain.
Subdomains
6 discovered
Related public hostnames discovered around the verified domain from external signals, including forgotten or unexpected hosts.
Public services
4 observed
Externally reachable services identified through safe, non-destructive checks on internet-facing infrastructure.
Cloud storage
2 linked assets
Publicly reachable cloud buckets and storage endpoints linked to the domain through hostnames or published references.
Registration
WHOIS records
Registrar, expiry and other public registration records that can signal takeover or renewal risk for the verified domain.
Scroll
Prioritisation
Not every finding carriesthe same weight.
EightScope weighs severity and confidence to separate material external risks from findings that need validation or context. So the issues most likely to matter are easier to see first.
Ranked
The important findings rise.
Higher-severity, higher-confidence issues move up the list. Lower-confidence and informational findings stay visible without distracting from what needs attention now.
Actionable · What to work on first
Know what to fix first.
EightScope turns findings into prioritised remediation guidance, showing what was found, where it was found, why it matters and the recommended next step.
How it works
From verified domain to actionable findings
Verify ownership, choose your scan coverage and receive prioritised remediation guidance.
- 01
Step 01
Add and verify your domain
Add a DNS TXT record to confirm ownership. Verification usually takes only a few minutes.
DNS TXT ownership check
Awaiting verificationDomain verification
example.com.au
Record type
TXT
Host / name
Copy_eightscope-verify.example.com.au
Verification value
Copyeightscope-domain-verification=8s_demo_a1b2c3d4e5f6
DNS updates may take time to appear. If the check fails, wait for propagation and try again.
- 02
Step 02
Choose your scan coverage
Select Quick, Standard or Full based on the level of external coverage you need.
External assessment depth
Scan configuration
Choose coverage for example.com.au
Quick
Fast external overview
7 modules
Typical time varies by target
Standard
Broader security assessment
15 modules
Typical time varies by site size
Full
Complete available external coverage
26 modules
Duration varies with discovered assets and enabled options
Coverage7/26 modulesFaster, lightweight assessment. Checks DNS, TLS, headers, and basic web exposure on the verified apex only. No port scan or subdomain discovery.
- 03
Step 03
Prioritise what matters
Review findings by severity, affected asset and recommended action.
Severity, asset and guidance
Findings
Prioritised remediation guidance
Finding Asset Severity Status DMARC policy not enforced example.com.au high Open HTTP Strict Transport Security missing www.example.com.au medium Open Cookie security flags incomplete app.example.com.au low Open Selected finding
DMARC policy not enforced
- Why it matters
- Without an enforced DMARC policy, spoofed mail can more easily impersonate your domain.
- Evidence
- Public DMARC record reports p=none.
- Recommended action
- Move DMARC from monitoring to an enforcing policy after reviewing reports.
No agent or application credentials required.
Platform
One platform. Clear external visibility.
Replace stitching together five different scanners with a single view of your website, DNS, email and public infrastructure.
Tiered scan coverage
Quick (7), standard (15), and full (26) scan depths. Full scans run all 26 external security modules, including typosquat, CVE lookup, and login-panel discovery.
Quick
7 modules
Standard
15 modules
Full
26 modules
Attack surface discovery
Subdomain enumeration, technology fingerprinting, and exposed asset inventory.
- └ verified-domain
- ├ www
- └ api
Change detection
Track score changes, new findings, and regressions across scans with PostgreSQL-backed history.
Prioritised findings
Severity and confidence separate material external risks from noise, so you know what to fix first.
SSL & header analysis
Certificate health, security headers, cookie analysis, and WAF detection.
Strict-Transport-Securitypresent
Content-Security-Policyreview
X-Frame-Optionspresent
Actionable fixes
Weighted scoring with Top 5 prioritized remediation recommendations.
- criticalOpen admin path
- highDMARC policy
- mediumTLS configuration
Open methodology
See exactly what gets checked and how results are scored.
EightScope publishes scan depths, coverage states and scoring treatment. You can see which checks ran, what they observed, and why a finding was raised.
- 1Verify domain
- 2Discover assets
- 3Assess exposure
- 4Score findings
- 5Track changes
Standard scan
15 modules · Typical time varies by site size
Broader security assessment for ongoing monitoring: core modules plus subdomain discovery, without the slowest deep checks.
- Subdomain discovery
- Common ports
- Broader coverage
- Core + extended modules
Trust
Security software should explain how it operates.
EightScope publishes how scanning works, what is stored, and where the product’s limits are, without dressing risk indicators up as guarantees.
Pricing
Start free. Upgrade when monitoring becomes essential.
AUD pricing with clear plan limits. Full feature comparison lives on the pricing page.
Starter
A low-cost paid trial for one domain.
$10/month
AUD
- 1 domain
- 100 monthly scan credits
- Quick, standard, and full scans
- Weekly monitoring (standard default), included free
Pro
RecommendedSecurity monitoring for small businesses.
$29/month
AUD
- 3 domains
- 400 monthly scan credits
- Daily monitoring (full default), included free
- Choose days and scan frequency
Business
Built for agencies, MSPs, and multi-domain teams.
$99/month
AUD
- Up to 10 domains
- 1,000 monthly scan credits
- Daily monitoring (full default), included free
- Custom days and scan frequency
FAQ
Straight answers before you start a scan.
Coverage, verification, scan depths and what EightScope is, and is not.
View all FAQsEightScope monitors your website, DNS, email and public infrastructure. It examines internet-facing systems connected to a verified domain and helps identify exposed services, weak configurations, unexpected assets and changes over time.
It is designed to give small and medium businesses and managed service providers a clearer view of externally observable security risk.
No. EightScope performs non-destructive external security checks and attack-surface discovery.
It does not attempt to exploit vulnerabilities, bypass authentication, brute-force credentials, inject SQL, execute cross-site scripting attacks or test internal networks. A professional penetration test can provide deeper manual validation that EightScope does not replace. See the scan methodology for more detail.
Depending on the selected scan type, EightScope can assess areas including:
- DNS and email authentication
- TLS certificates and protocol configuration
- HTTP security headers and cookie settings
- open ports and publicly reachable services
- exposed files, directories, login panels and API surfaces
- subdomains and Certificate Transparency activity
- public JavaScript libraries and secret-like patterns
- cloud-storage exposure indicators
- typosquatted domains and reputation signals
Exact coverage depends on the scan type, selected options, plan and whether individual checks complete successfully.
Domain verification helps confirm that you control the target or have permission to assess it. This prevents EightScope from being used as a general-purpose scanner against unrelated third-party systems.
DNS changes may take time to become publicly visible. If verification does not work immediately, check the TXT record and allow time for DNS propagation.
Quick scan (7 modules)
A fast preview of the verified root domain using the core DNS, TLS, header and basic web-exposure checks. It does not include port scanning or subdomain discovery.
Standard scan (15 modules)
The recommended regular baseline. It adds broader external checks, common-port assessment and subdomain discovery while excluding the slowest modules.
Full scan (26 modules)
The broadest available module coverage. It includes deeper checks such as typosquatting, CVE matching, login-panel discovery and additional public exposure analysis.
A Full scan still uses the normal port profile unless the deep port-scan option is selected.
No. EightScope works from the public internet and does not require an agent to be installed on your servers or devices.
EightScope does not currently perform authenticated application testing, so application usernames and passwords are not required.
Ready to monitor your external footprint?
Run your first scan in minutes. No credit card required.