See your site the way an attacker does.

Orb44 scans your domain to uncover public-facing vulnerabilities, misconfigurations, and data leaks before attackers do. Informational perimeter snapshot for site owners and authorized admins. Enter a domain. Nothing to install. Not a licensed pentest, not PCI QSA, not AI-code SAST, and not a prompt-injection scanner.

How it works

Three steps. Full results in under five minutes. 1) Enter the domain: the site exactly as an attacker sees it, no install. 2) Map the attack surface: open ports, admin panels, vulnerable scripts, blocklist hits. Only what is already publicly accessible. 3) Clear, actionable results: a grade, facts, and step-by-step remediation.

What we check

Perimeter and whether traffic skips the shield; CMS admin surfaces; APIs, CORS, GraphQL; MCP tools/list without login and API keys in public JavaScript (no jailbreak, no tool calls); databases on the internet (banner only); checkout widgets; mail (MX/SPF/DKIM/DMARC); forgotten files; Safe Browsing and Spamhaus. WordPress, WooCommerce, Shopify, and n8n/Flowise/Dify panels when they apply.

Optional satellite

One command on a VPS you control: listeners, Docker rights, load — things an outside scan cannot see — on the same card. Open source: https://github.com/OrbSec/satellite. Shopify and managed hosting have nowhere to install it; the outside check still runs.

Watch

Compares snapshots over time (shield, TLS, ports, checkout, load when a satellite is on). Optional Telegram and Slack alerts. Cadence increases while confirmed critical or high findings stay open.

Pricing

Free public tools without an account. Full snapshot and Watch in the dashboard: about $15/week or $45/month, or $120/month for up to 5 domains. Week is a paid weekly subscription, not a free trial. Cards via Stripe.

Public tools

Free without an account: blocklist, shield, CDN leaks, lookalike certificates, a shareable orb44.com/s/<host> permalink, webhooks, AI keys in public JS, n8n/Flowise editor (GET only), MCP tools/list (names only). Not a prompt-injection scanner.

Links

• is my site flagged? — Public blocklist / Safe Browsing style check for authorized site owners.
• Cloudflare / shield exposure — Public check: does Cloudflare or another CDN actually front the site?
• CDN leak catalog check — Does the homepage still load scripts from known compromised CDNs?
• lookalike certificate check — Has Certificate Transparency already issued a cert for a name like yours (typo or homograph)?
• shareable public snapshot — Stable URL orb44.com/s/<host>: shield, blocklists, lookalike certificates. No login. Origin IP is not shown.
• public webhook URL check — Find callback URLs in public JS: secrets in the URL and same-host hooks without clear auth.
• AI / LLM keys in public JS — Patterns for OpenAI / Anthropic / Google Generative AI on the homepage. Keys are never sent to vendor APIs.
• is the n8n editor open without login? — GET-only check: does n8n, Flowise, Langflow or Dify return editor data without a password? We never run a workflow.
• does MCP tools/list answer without login? — One JSON-RPC tools/list on /mcp and /sse. Result is yes/no plus tool names. Descriptions are not shown. Not a prompt-injection scanner.
• WordPress XML-RPC on the internet — Explanation of the XML-RPC exposure check. The live probe lives in the dashboard, not on this page.
• open .git on the internet — In the dashboard Orb44 checks /.git/HEAD and the file tree without reading contents. No public .env/.git fetcher.
• polyfill.io exposure check — Check whether the site still loads polyfill.io or related compromised script hosts.
• WooCommerce on your VPS: grade D → B in a week — Composite example from product checks: guest orders, shop plugins, an open database — then plugins updated and the grade moved from D to B. Not a named client. Not a pentest.
• WordPress example: not a shop, still exposed — Composite example from product checks on a non-commerce WordPress site: an outdated plugin with a known CVE, exposed admin username via wp-json, and an open XML-RPC endpoint used for brute-force amplification.
• Shopify example: password page, public catalog — Composite example: a Shopify storefront in password mode still exposed its full catalog via products.json/collections.json, and an App Proxy path answered to more than GET. Outside-only checks, no satellite needed.
• automation panel example: open n8n editor — Composite example: an n8n/Flowise/Langflow-style automation editor reachable without login, exposing workflows with embedded API keys and webhook secrets. Read-only, GET-only check.