ALCE Consulting ALCE
Ghost · Website Security Scanner · Live Now

See your domain the way
an attacker sees it.

Ghost runs a broad external security audit of your website — SSL configuration, HTTP headers, open ports, CVEs, exposed admin panels, breach data, JavaScript secrets, and 13 more attacker-visible vectors. No login required. No technical background needed.

Run Free Scan Full Audit · $79 one-time

Free quick scan · 4 checks · No account · No credit card

21
Security Checks
<8m
Full Audit Time
$0
To Start
0
Accounts Required
What makes Ghost different

Ghost covers what most scanners miss.

Free tools check SSL or headers — not both, and definitely not 21 vectors. Paid enterprise tools cost thousands and require an IT team. Ghost closes that gap.

Built from 15+ Years of DoD Security Experience
Built by an operator with 15+ years inside DoD and national security systems — applying external threat analysis discipline to your domain.
Zero Friction Entry
No account creation. No software to install. No technical knowledge required. Enter your domain and Ghost does the rest in under 8 minutes.
Audit-Defensible PDF Report
The full audit delivers a scored PDF with plain-English findings and prioritized remediation steps — shareable with investors, auditors, or enterprise clients.
External Attacker Perspective
Ghost scans from outside your network — exactly as an attacker would. No agent installed. No internal access required. Pure external exposure analysis.
JavaScript Secret Detection
Ghost scans your public JavaScript bundles for exposed API keys, credentials, and tokens — invisible to most scanners, devastating in practice.
Plain-English Results
Every finding is explained without jargon — severity score, what it means, and how to fix it. No security background required to act on the results.
Full coverage

21 Checks. One Report.

The quick scan covers your foundation at no cost. The full audit covers the most common attacker-visible vectors an enterprise auditor would check.

Foundation Free Quick Scan
SSL / TLS Certificate
Expiry, configuration grade, cipher strength, and certificate chain validation.
HTTP Security Headers
HSTS, CSP, X-Frame-Options, Referrer-Policy, Permissions-Policy, and more.
DNS Records
A, CNAME, MX, and TXT record analysis for misconfigurations and exposure.
Email Security
SPF, DKIM, and DMARC — the controls that stop email spoofing and phishing.
Infrastructure Full Audit
Port Scanning
TCP probes across common ports on your public IP — finds unnecessary exposure.
Subdomain Enumeration
DNS queries and certificate transparency lookups to map your full attack surface.
WAF Detection
Identifies web application firewall presence and vendor fingerprinting.
Redirect Chain Analysis
Traces HTTP redirect chains for open redirects and misconfigured hops.
Intelligence Full Audit
CVE Cross-Reference
Technology stack fingerprinting matched against current known vulnerabilities.
CMS Fingerprinting
WordPress, Drupal, Joomla, and other CMS version detection for targeted CVE matching.
Breach Data Lookup
Your domain matched against public breach records from known data compromises.
Third-Party Risk
Identifies external scripts and assets loaded from third-party domains.
Exposure Full Audit
Admin Panel Exposure
42 common admin paths checked for public accessibility.
JavaScript Secret Scanning
Public JS bundles scanned for exposed API keys, credentials, and tokens.
Sensitive File Exposure
Probes for publicly accessible .env, backup, config, and log files.
API Exposure
Scans for publicly accessible API endpoints and unauthenticated routes.
Risk Full Audit
CORS Configuration
Cross-origin policy probed for overly permissive settings that enable data theft.
Cookie Security
Flags missing HttpOnly, Secure, and SameSite attributes on session cookies.
Domain Impersonation Risk
Checks for registered lookalike domains and typosquat variants targeting your brand.
Auth Surface Mapping
Discovers publicly exposed login, registration, and password reset endpoints.
robots.txt Analysis
Reviews directives for unintentionally exposed paths or sensitive endpoints.
Who needs this

Before an investor, auditor, or
attacker runs this scan — you should.

Ghost is built for anyone who owns a domain and needs to know their exposure. No security background required.

Founders approaching a funding round
Investors run security checks before wiring money. Ghost tells you exactly what they'll find — and gives you time to fix it first.
Businesses pursuing enterprise clients
Enterprise procurement includes vendor security reviews. A scored, audit-defensible Ghost report answers those questions before they're asked.
SMBs without a security team
You don't need an IT department to know if your domain is exposed. Ghost returns plain-English findings with specific remediation steps.
Agencies delivering client reports
Run Ghost on every client domain. The PDF is client-ready, scored, and professional — no manual assembly required.
Defense contractors preparing for CMMC
External domain posture is part of your compliance surface. Ghost provides the external attack surface analysis your assessment will expect.
Any domain owner who wants to know
Attackers scan domains constantly. Ghost lets you see what they see — before they decide to act on it.
Pricing

Start free. Go deeper when you're ready.

No account required for the quick scan. One-time payment for the full audit — no subscription, no recurring charges.

Quick Scan
Free
4 foundational checks. No account, no credit card. Results in minutes.
  • SSL / TLS certificate analysis
  • HTTP security headers review
  • DNS record analysis
  • Email security — SPF, DKIM, DMARC
Run Free Scan →
Full Coverage
Full Audit
$79 one-time
All 21 checks. Scored PDF report delivered by email. Pay once, no subscription.
  • Everything in Quick Scan
  • Port scanning + subdomain enumeration
  • CVE cross-reference + CMS detection
  • Breach data + JS secret scanning
  • Admin exposure + CORS + Cookie security
  • Domain impersonation + Auth surface
  • Scored PDF report — audit-defensible
Run Full Audit →

Attackers scan domains constantly.
Run Ghost on yours first.

Free scan. No account. Under 8 minutes.

Run Free Scan Now →