Update, 27 August 2026 — ClickScan is live and open to everyone. This was first published in July as a preview of something we were still building. Everything below is the product running in production today: no invitation, no waiting list, and public sign-up open to anyone.
Most people who own something on the internet are not security specialists. They run a shop, a practice, an agency, a small SaaS. They have a website, a mail domain and a couple of servers — and no realistic way to answer a simple question: is any of this configured badly enough to hurt me?
The usual answers are bad. Hire a consultant, and you get an excellent report once a year for money that does not fit a small budget. Run a free scanner, and you get a wall of CVSS scores, protocol names and severity codes that tell you something is wrong without telling you what to do about it. Do nothing, and you find out the hard way — an expired certificate on a Saturday, a customer forwarding you a phishing email that came convincingly from your own domain.
ClickScan is our answer to that gap, and it is now live.
It runs the same checks our penetration testers run by hand, on a schedule you choose, and writes the result the way a colleague would explain it: what you have, how serious it is, and exactly what to do about it. No jargon to decode before you can act, no consultant to book, no contract to sign.
This is what a finding looks like. A severity, one sentence of plain English, and the fix — not a CVSS vector to decode.
Update, 27 August 2026: it is live
This post was first published on 29 July 2026, when ClickScan was still in testing. It has been updated rather than replaced, because what it described is what shipped.
ClickScan is running in production. Every check below works today, on real assets, and the platform is taking payments.
Sign-up is open to everyone. No invitation, no waiting list: create an account with your email address — there is no password and no card — and new accounts get free starter credits, so your first check costs nothing.
Several checks have shipped since this post was first written, and they are described in their own section further down.
The checks
SSL/TLS certificate and encryption. Is your HTTPS valid, trusted and modern? Certificate expiry and trust chain, every protocol version and cipher suite your server actually accepts, forward secrecy, HSTS, OCSP stapling, certificate transparency and CAA — graded from A+ down to F. Named weaknesses are actively probed, not guessed: Heartbleed, POODLE, ROBOT, DROWN, Logjam, CRIME, Ticketbleed, CCS injection, insecure renegotiation and the CBC padding-oracle family. If we cannot complete a test, the report says "not tested" rather than quietly passing you.
HTTP security headers. Whether your site sends the response headers that protect your visitors — HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy — plus the cross-origin isolation headers, anything deprecated, and the headers that quietly advertise which software and version you are running.
Email security (SPF, DKIM, DMARC). Can scammers send email as you? We check your mail servers and your full email authentication set: MX, SPF, DKIM, DMARC, MTA-STS, TLS-RPT and BIMI. The report carries the raw DNS answers we read, plus a generator that writes out the exact records to paste into your DNS panel — already filled in with your domain, because the most common way this goes wrong is a record published with example.com still in it.
Email spoofing test. We actually try to deliver a forged message to your own domain and show you whether it got through. Proof, not theory. It is one fixed, plain-text message that explains itself, and it can only ever be sent to an address at the domain being tested. If your mail server refuses it for the wrong reason — a mailbox that does not exist, say — we report the test as inconclusive instead of calling it a pass, because a false all-clear is worse than no test.
Email breach exposure. Which known breaches one of your addresses appears in, and what types of data each one held — passwords, addresses, phone numbers. A mailbox is an asset in its own right here, so it gets the same history, scheduling and reports as a domain. We never receive the breached values themselves, and there is nowhere in our system to put them.
Brand Impersonation Monitor. Which domains somebody has registered to look like yours — and, more usefully, which of them are actually dangerous. Thousands of variations of your name are generated and resolved against DNS, mail servers and the public certificate logs, and each one gets a verdict: yours, another company's brand protection, parked, or live and able to receive mail. The report leads with how many are worth acting on rather than how many exist, and the findings export as STIX or YARA for your own blocklists.
Port Scan. Which ports on a host are reachable from the internet, and what is answering on them. It connects to your infrastructure, so the asset has to be proven yours first.
Shipped since this post was first written
Everything above was in the original July preview. These landed afterwards, and all of them run today.
Brand impersonation — deep sweep. The same lookalike check, much wider: every country ending rather than the common ones, two look-alike substitutions at once, and every single-character typo.
Port Scan — full range. All 65,535 ports rather than the ones services are traditionally assigned to, and each open port is asked what it is running instead of being guessed at from its number.
Subdomain discovery. The other names attached to your domain — the staging site, the old gateway, the thing a contractor set up and left running — and the ones still pointing at a cloud service nobody pays for any more, which anybody can claim and then serve their own content from your domain, with a valid certificate. The deep sweep goes wider and a level further down, and reads each host's icon to identify the software, turning "this name suggests Jenkins" into "this host is running Jenkins".
Does your firewall actually cover everything? If your domain sits behind a filtering service — the kind that absorbs attacks before they reach you — subdomain discovery works out which of your hosts answer on their own address, around it. That is a way in that skips the protection you are paying for, and it is the finding owners tend to act on the same afternoon. Hosts that could never sit behind such a service are deliberately left out, and if we do not hold a current copy of a provider's published addresses we say nothing at all rather than accuse your infrastructure on stale data.
What an attacker already knows. The port checks also report what a public internet-wide index already publishes about your addresses — what somebody learns about you for free, before touching anything of yours.
Two rules about how we grade
These are worth stating plainly, because they are the reason a grade from us is worth quoting to somebody else.
Somebody else's data never sets your grade. Part of a report is observed by a third party rather than by us. We show it — it is exactly what an attacker gets for free — and we keep it out of your grade, which reflects only what we tested ourselves. Those observations are counted separately from your findings.
Every list we look things up in has a date on it. Any list we did not write ourselves carries where it came from, when it was last refreshed and how far we trust it, and that limit is applied where the grade is worked out rather than at the end, so an exported report carries it too. Data we have not verified ourselves can add coverage, but it is not allowed to raise the alarm on its own. Where a list is too old to rely on, the check says nothing instead of guessing.
More checks are on the way. We list one the day it runs, not the day it is planned — if you need something specific, tell us.
Around the checks: the platform
A scanner on its own is a tool. What makes it usable by a non-specialist is everything around it.
Everything you watch in one list — with the grade it currently holds and when it was last checked. Screens are from a demo account.
- Assets you actually own. Keep an inventory of the domains, IP addresses and mailboxes you watch, imported and exported as CSV. For the deeper checks we ask you to prove an asset is yours, in whichever way suits it: a DNS TXT record, a file at
/.well-known/, a code emailed to an address at the domain, a callback from the IP itself, or reverse DNS. - On demand, booked, or recurring. Run a check now, book it for a date and time in your own time zone, or repeat it daily, weekly or monthly. Recurring runs are discounted, so continuous monitoring stays cheap — and if a scheduled run cannot be paid for, we tell you and leave the schedule active.
- Your whole estate in one go. Select many assets and many checks at once; the wizard asks only for what each one needs, skips combinations that do not apply, and shows the total cost before you spend a credit.
- Reports people actually read. An A+ to F grade, a line naming the finding that drove that grade, and findings written as "what you have / how bad it is / what to do" — each marked with how we know it, whether we proved it or read it from a published record. Underneath sit the cipher tables, raw DNS answers and per-weakness verdicts for whoever wants the evidence. Export one scan as a PDF, or one report covering every check on an asset, as an executive summary or in full.
- What changed since last time. Each scan is compared with the previous one for the same asset and check, and you only hear from us when something actually moved — leading with what got worse and naming it, rather than an identical email every morning.
- "We know, that one is fine." Mark a finding as not applicable on one asset, with a reason on the record. It always expires, it never changes the grade, and it is hidden rather than deleted — so the report you hand a client is still the truth.
- Your brand on the report. Agencies and consultants can put their own logo and colour on the PDFs.
- Alerts that arrive before the problem. You are told before a TLS certificate expires — at 30, 7 and 1 day, and again if it lapses — when a scan finishes or fails, and when something changed. In the app and by email.
- One view of your exposure. A dashboard answering the questions worth asking: which assets are worst, how many open findings and how serious, how much of what you own has actually been checked, and whether your grades are improving.
What it costs
Pay as you go. You buy credits and spend them on the scans you actually run — no subscription, no per-seat fee, no lock-in. New accounts get free starter credits, recurring runs are discounted, and referrals earn credits for both sides.
Two things we think are only fair: a scan that fails is refunded automatically, and a check that had nothing to test — a spoofing test against a domain that receives no email, say — is graded "not applicable" and refunded rather than sold to you as a good result. Credits you pay for do not expire; free ones last twelve months from the day they are granted and are always spent first.
Who it is for
- Freelancers and solo makers — check your own sites and your clients' without hiring a pentester, and look more professional doing it.
- Startups — ship fast without leaving security behind, on a startup budget and with no security hire.
- SMEs and IT teams — keep an eye on your domains, certificates and email without a dedicated security team, with reports you can put in front of management.
- Agencies and MSPs — monitor every client from one place using separate groups, and hand each one a clear, branded report they understand.
- Enterprise and security teams — lightweight, continuous external monitoring alongside your existing stack.
- Bug bounty hunters and researchers — fast recon on authorized targets, graded and exportable.
What you are allowed to scan
The passive checks — TLS, headers, email records — read public data. For active checks you confirm you are authorized to test the target, and for the deepest ones we also ask you to prove the asset is yours. There are light limits by default (two concurrent scans against the same host, 200 queued per account) to keep our scanning gentle on the systems you point us at. If you run infrastructure and would rather we never touched it, write to abuse@clickscan.ai and we will block it platform-wide.
Getting an account
ClickScan is live and open to everyone. Create an account with your email address, add your first asset, and read a plain-language report a couple of minutes later. Free starter credits, no card, no subscription.
ClickScan is built by ClickSecure AI, whose team has spent 15+ years doing this work by hand. When automation is not enough, the same people run the manual penetration test.