Know what your site exposes.

Orb44 is a website security scanner. It checks what your site already exposes to the public internet. Informational perimeter snapshot for site owners and authorized admins. Enter a domain — nothing to install. Not a licensed pentest, not PCI QSA, not AI-code SAST, and not a prompt-injection scanner.

How it works

Three steps, usually about five minutes. 1) Enter the domain — the site as the street sees it. 2) We collect what is already reachable: open panels, ports, checkout, public scripts, threat lists. 3) One findings card: grade, facts, and what to close. A model writes a brief from that card, not generic advice.

What we check

Perimeter and whether traffic skips the shield; CMS admin surfaces; APIs, CORS, GraphQL; MCP tools/list without login and API keys in public JavaScript (no jailbreak, no tool calls); databases on the internet (banner only); checkout widgets; mail (MX/SPF/DKIM/DMARC); forgotten files; Safe Browsing and Spamhaus. WordPress, WooCommerce, Shopify, and n8n/Flowise/Dify panels when they apply.

Optional satellite

One command on a VPS you control: listeners, Docker rights, load — things an outside scan cannot see — on the same card. Open source: https://github.com/OrbSec/satellite. Shopify and managed hosting have nowhere to install it; the outside check still runs.

Watch

Compares snapshots over time (shield, TLS, ports, checkout, load when a satellite is on). Optional Telegram and Slack alerts. Cadence increases while confirmed critical or high findings stay open.

Pricing

Free public tools without an account. Full snapshot and Watch in the dashboard: about $15/week or $45/month, or $120/month for up to 5 domains. Week is a paid weekly subscription, not a free trial. Cards via Stripe.

Public tools

Free without an account: blocklist, shield, CDN leaks, lookalike certificates, a shareable orb44.com/s/<host> permalink, webhooks, AI keys in public JS, n8n/Flowise editor (GET only), MCP tools/list (names only). Not a prompt-injection scanner.

Links

• is my site flagged? — Public blocklist / Safe Browsing style check for authorized site owners.
• Cloudflare / shield exposure — Public check: does Cloudflare or another CDN actually front the site?
• CDN leak catalog check — Does the homepage still load scripts from known compromised CDNs?
• lookalike certificate check — Has Certificate Transparency already issued a cert for a name like yours (typo or homograph)?
• shareable public snapshot — Stable URL orb44.com/s/<host>: shield, blocklists, lookalike certificates. No login. Origin IP is not shown.
• public webhook URL check — Find callback URLs in public JS: secrets in the URL and same-host hooks without clear auth.
• AI / LLM keys in public JS — Patterns for OpenAI / Anthropic / Google Generative AI on the homepage. Keys are never sent to vendor APIs.
• is the n8n editor open without login? — GET-only check: does n8n, Flowise, Langflow or Dify return editor data without a password? We never run a workflow.
• does MCP tools/list answer without login? — One JSON-RPC tools/list on /mcp and /sse. Result is yes/no plus tool names. Descriptions are not shown. Not a prompt-injection scanner.
• WordPress XML-RPC on the internet — Explanation of the XML-RPC exposure check. The live probe lives in the dashboard, not on this page.
• open .git on the internet — In the dashboard Orb44 checks /.git/HEAD and the file tree without reading contents. No public .env/.git fetcher.
• polyfill.io exposure check — Check whether the site still loads polyfill.io or related compromised script hosts.
• WooCommerce on your VPS: grade D → B in a week — Composite example from product checks: guest orders, shop plugins, an open database — then plugins updated and the grade moved from D to B. Not a named client. Not a pentest.
• WordPress example: not a shop, still exposed — Composite example from product checks on a non-commerce WordPress site: an outdated plugin with a known CVE, exposed admin username via wp-json, and an open XML-RPC endpoint used for brute-force amplification.
• Shopify example: password page, public catalog — Composite example: a Shopify storefront in password mode still exposed its full catalog via products.json/collections.json, and an App Proxy path answered to more than GET. Outside-only checks, no satellite needed.
• automation panel example: open n8n editor — Composite example: an n8n/Flowise/Langflow-style automation editor reachable without login, exposing workflows with embedded API keys and webhook secrets. Read-only, GET-only check.