Hacka Serverearly access
Hacka Server checks your site from the outside, the way an attacker would: web settings, certificates, DNS, email protection and the software it gives away. You get a health score, every issue with its fix, and a daily check that tells you what has changed.
Security headers, cookies and redirects that tell browsers how to protect visitors.
Expiry dates, old TLS versions and weak settings on your HTTPS connection.
SPF, DMARC and MTA-STS, so nobody can send email pretending to be you.
Records that control where your domain points and who can issue its certificates.
Server software your site reveals, matched against known serious vulnerabilities.
Hacka Code reads what you write. Hacka Server looks at what the internet can see of the server it runs on: the view an attacker gets before they try anything.
Inside view
Outside view
“Attackers start from the outside. So does Hacka Server.”
no logins · no agents · nothing to installNot a one-off audit that goes stale. A check that keeps running, so you always know where you stand.
Hacka checks your web settings, certificates, DNS, email protection and the software your server reveals, with close to fifty checks.
Every issue is ranked by severity, with the evidence your server showed and plain fix guidance. No security jargon to decode.
Daily scans at a time you choose show what's new, what's fixed and what came back, with your health score tracked over time.
What happens when you press scan, in the order it really happens. Six stages, one clear to-do list.
We only scan what you can prove is yours. Your site, your key, your scan.
Hacka sees what everyone else can see. Now you can too. No logins, no agents, just the outside view.
The settings attackers check first, checked for you.
Your server is telling everyone what it runs. Hacka checks what that means.
Every issue comes with the fix. Your list, your call: dismiss what doesn't apply.
Fixed it? Tomorrow's scan will show it. New exposures caught the day they appear.
Verify a domain, press scan and get your health score in minutes. Free during early access.
Your health score out of 5, every issue with its evidence and fix, and a history that shows what changed since yesterday.
Server scanners are often noisy. Hacka Server only reports what your server actually showed, and never touches anything it shouldn't.
No domain is scanned without proof of ownership, re-checked before every run.
Each issue shows what was seen, so your team can check it for themselves.
Software versions come only from what your server shows. CDNs are called out, never mistaken for your server.
An issue is only marked fixed when the check that raised it has run again and passed.
A slow or flaky network never stops your daily scans. Only proof that's truly gone pauses a domain.
Close to fifty checks across the settings attackers look at first, on the host you verified and its www. version. Here are some of the questions Hacka answers.
How your site tells browsers to protect visitors.
Does plain HTTP redirect to HTTPS?redirects
Is HTTPS enforced with HSTS?HSTS
Is there a Content-Security-Policy?CSP
Can other sites frame your pages?security headers
Do cookies carry the Secure and HttpOnly flags?cookie flags
The lock in the address bar, and what sits behind it.
Is the certificate valid for this domain?validity
How long until it expires?expiry
Are old TLS 1.0 and 1.1 still accepted?TLS versions
Is weak encryption still offered?encryption
Whether someone could send email that looks like it came from you.
Is there an SPF record saying who may send?SPF
Is DMARC set to quarantine or reject?DMARC
Is mail in transit protected with MTA-STS?MTA-STS
Are delivery problems reported to you?TLS-RPT
The records that control your domain, and how researchers reach you.
Does a CAA record limit who can issue certificates?CAA
Is a security contact published for researchers?security.txt
The software your site reveals, checked against what's known.
Which software and versions does your site reveal?PHP, Node.js, nginx, Apache, OpenSSL, IIS, Drupal, jQuery
Is any of it out of support?end of life
Does any have well-known serious vulnerabilities?known issues
Is a CDN hiding the real server?CDN aware
Hacka Code checks what you write. Hacka Server checks where it runs. One account for both, in the same Hacka app.
Your source code, dependencies and secrets, proven before they're reported.
What the internet can see of your server, checked every day.
Specialist manual testing, typically once or twice a year.
Get a clear, ranked to-do list instead of a wall of warnings.
Verify a domain and scan it as often as you like, with daily scans, health scores and run history included. It lives in the same Hacka account as Hacka Code.
Still unsure? Talk to us or get early access and see for yourself.
Hacka Server is an outside-in security scanner for your website's server. It checks what the internet can see: web security settings, certificates and encryption, DNS, email protection and the software versions your server gives away. You get a health score out of 5, every issue with its fix, and optional daily scans that show what has changed.
Yes. Hacka only reads what a browser or mail server would see anyway. It never logs in, sends forms or tries to break in.
So that only the owner of a site can scan it. You add a small key file or a DNS record, and Hacka checks it again before every scan.
No. Hacka Server scans from the outside, so there is nothing to install on your server.
Each scan covers the host you verified and its www. version. Other subdomains are verified and scanned on their own.
Yes. Hacka checks what it can see and tells you when a CDN is hiding your real server, rather than reporting the CDN's details as yours.
As often as you like on demand, and every day at a time you choose if you turn on daily scans. Each run is compared with the last, so you can see what's new, what's fixed and what came back.
Dismiss it. It stays out of your list until you bring it back.
Hacka Server is free while it's in early access. Sign up for a Hacka account to verify a domain and start scanning.
Yes. Code scans and server scans live side by side in the same Hacka app and the same team account. Hacka Code checks what you write; Hacka Server checks where it runs.
An AI pen-test mode is on the way. Today's scans look and report; they never attack.
Hacka Code live
AI security scanning for your source code and software supply chain. Finds vulnerabilities, proves which are exploitable and shows how to fix them.
Explore Hacka CodeHacka Dev coming soon
Testing for your website's front end: responsive layouts across screen sizes and the front-end code that powers them.
About Hacka Dev<Scan.Exploit.Secure>
Verify a domain. Scan in minutes. Then let Hacka keep watching, free during early access.