Question 1

What is Hard2bit Scanner?

Accepted Answer

Hard2bit Scanner is a SaaS application developed by Hard2bit S.L. that evaluates the public security posture of any domain through 25 automated controls across six categories — Network, Web, Identity, Data exposure, Reputation and Compliance — and additionally measures the domain's readiness for the AI-agent era with up to 11 emerging standards.

Question 2

Is it really free to start?

Accepted Answer

Yes. The Anonymous tier allows three scans every 24 hours per IP with no signup, right on this page. The Free plan is permanent and gives you three scans per month with full score, grade and detailed findings on the 14 free checks, plus preview findings on Premium checks. No credit card required to start.

Question 3

What privacy guarantees do I get about my domain?

Accepted Answer

Analysis is 100% passive. Hard2bit Scanner installs no agents, accesses no private resources and runs no intrusive tests. It only queries public sources: DNS, HTTP headers, Certificate Transparency logs, threat-intelligence feeds and open data. Hard2bit S.L. is the data controller under GDPR.

Question 4

Can I scan client or third-party domains?

Accepted Answer

Yes. Because the analysis is passive and based on public information, it does not require explicit authorization from the domain owner. We still recommend informing the client beforehand. If your contractual relationship with the client requires formal authorization, obtain it before scanning.

Question 5

How does Hard2bit Scanner differ from pentesting?

Accepted Answer

Pentesting is a manual engagement with controlled exploitation of vulnerabilities inside a contractual scope. Hard2bit Scanner is an automated passive analysis of the public posture, useful as continuous visibility and as the entry point to pentesting when a finding justifies it. They are complementary, not substitutes.

Question 6

Is it valid as audit evidence for NIS2, DORA or ENS?

Accepted Answer

It is a complementary source of technical evidence. The report documents the externally observable posture at a point in time and leaves traceability of findings about public surface, supply chain and configuration of headers, DNS and email. Formal audit defense should combine this with the rest of the ISMS or in-scope system evidence.

Question 7

What is Agent Readiness and why does it matter?

Accepted Answer

Agent Readiness measures whether a website is prepared to be discovered, interpreted and operated by AI agents. Hard2bit Scanner evaluates up to 11 emerging standards from 2025-2026 (llms.txt, Content-Signal, MCP Server Cards, Agent Skills, RFC 9727 and 9728, among others) — territory most classic scanners do not yet cover.

Question 8

Is there an API to integrate the scanner?

Accepted Answer

Hard2bit Scanner is currently operated through its web interface. A public API is on the roadmap and will be released first for Pro and Enterprise customers. If you need integration with a SIEM, ticketing system or in-house portal, write to info@hard2bit.com to discuss a custom plan.

Question 9

How does plan switching work if I need more volume?

Accepted Answer

A Starter → Pro upgrade is prorated and charges only the difference for the current period. A Pro → Starter downgrade takes effect at the end of the paid period. There is no commitment: you can cancel anytime and keep access until the current billing cycle ends.

Question 10

What happens if the scanner finds critical issues?

Accepted Answer

Hard2bit Consulting can take over the remediation with professional services: technical pentesting, incident response, NIS2/DORA/ENS readiness, infrastructure audit, cloud and Microsoft 365 hardening. It is the natural next step when the public posture reveals issues that require manual intervention.

Question 11

Do you refund if the product doesn't work for me?

Accepted Answer

Yes. You have 14 days from the first charge to request a full refund with no need to justify the reason. Write to support@hard2bit.com and we process refunds within 24-72 hours.

Question 12

Who is behind Hard2bit Scanner?

Accepted Answer

Hard2bit Scanner is a product of Hard2bit S.L., a Spanish cybersecurity company founded in 2013, headquartered in the Community of Madrid. Hard2bit is certified to ISO 27001, ISO 9001, ISO 14001, ISO 22301 and ISO 20000-1, accredited to ENS High category, and a member of ISMS Forum, CyberMadrid, ASLAN and UN Global Compact.

Question 13

What is an agentless security scan and why does it matter?

Accepted Answer

An agentless scan assesses a domain's security without installing software or requesting credentials: the website security scanner observes exactly what an attacker would see from the outside. Hard2bit Scanner applies this approach to your whole external attack surface — DNS, TLS, email, subdomains, public leaks — so you can scan your domain in minutes without deploying anything.

Question 14

Who is Hard2bit Scanner for?

Accepted Answer

For organisations without a dedicated security team that need to check their domain's security posture with technical evidence; for IT managers preparing for an audit or certification (ISO 27001, NIS2, DORA); and for anyone who has to answer a customer's security questionnaire with verifiable data instead of estimates.

Area	Control	What it detects	Plan
Network 3 controls	TLS / SSL	Certificate configuration, available cipher protocols and known cryptographic weaknesses.	Free
	DNS health	Server redundancy, DNSSEC, sensitive records and consistency across providers.	Free
	Exposed ports	Common ports reachable from the Internet that may expose admin services or management panels.	Premium
Web 5 controls	HTTP security headers	Recommended headers against code injection, UI hijacking and traffic manipulation.	Free
	Detected technologies	CMS, frameworks, libraries and server stack in use to flag outdated components.	Free
	Known public vulnerabilities (CVE)	Cross-reference of detected technologies against public CVE databases.	Free
	Cookie configuration	Cookie security attributes that could facilitate session theft if misconfigured.	Free
	Mixed content on secure pages	HTTPS pages loading resources over insecure channels and exposing user data.	Free
Identity 3 controls	Email security	SPF, DKIM, DMARC, MTA-STS and other public mechanisms that authenticate outbound mail.	Free
	Domain status	Expiration date, age, registrar and administrative status of the domain.	Free
	Certificate Transparency	Certificates issued in public CT logs to detect unauthorized issuance.	Free
Data exposure 8 controls	AI-era security posture	Posture against generative AI scrapers, training-data exposure and common AI-app endpoints left unprotected.	Premium
	Exposed cloud storage	Cloud buckets and admin panels reachable from the Internet that could leak files or credentials.	Premium
	Leaks in pastes and repositories	Mentions of the domain or associated credentials in public repositories and paste services.	Premium
	Subdomain takeover risk	Subdomains pointing to abandoned external services that an attacker could claim.	Premium
	AI dataset exposure	Domain content present in public archives that feed generative AI models.	Premium
	AI bot blocking	Configuration to block generative-AI scrapers (GPTBot, ClaudeBot, Google-Extended) via robots.txt, ai.txt and meta tags.	Free
	Certificate Transparency subdomains	Enumerates subdomains visible in CT logs and classifies them to surface dev/staging/admin environments.	Premium
	Vendor breach exposure	Third-party vendors in use (CRM, marketing, analytics, CDN) with documented public breaches — NIS2 supply-chain traceability.	Premium
Reputation 2 controls	Brand protection and typosquatting	Domains impersonating your brand: generates typo variants, discovers lookalikes via Certificate Transparency, probes each candidate over DNS, MX and HTTPS, and flags those with live infrastructure. Returns a Brand Exposure Score where 100 means a clean brand.	Premium
Reputation 2 controls	Threat intelligence	Presence of domain, IPs and mail servers in public spam, malware, phishing and botnet lists.	Free
Compliance 4 controls	security.txt file	Standard channel published so security researchers can responsibly report vulnerabilities.	Free
	Compliance signals	Public signals of best-practice adoption (cookies, privacy, GDPR, accessibility).	Premium
	Advanced AI Agent Readiness	The 7 emerging standards for autonomous agents — capability discovery, delegated authentication and interaction protocols — weighted higher in the Agent Readiness Score than the basic variant.	Premium
	robots.txt file	Internal paths inadvertently revealed and inconsistent indexing policies.	Free

Online cybersecurity scanner: check your domain's exposure in 30 seconds

Scan your domain now

What is Hard2bit Scanner and what does it check?

While classic scanners check 5 things, we check 50+

Fully passive, no agents

25 controls, not 5

First scanner with Agent Readiness

What security controls does the scanner run?

Network

TLS / SSL

DNS health

Exposed ports

Web

HTTP security headers

Detected technologies

Known public vulnerabilities (CVE)

Cookie configuration

Mixed content on secure pages

Identity

Email security

Domain status

Certificate Transparency

Data exposure

AI-era security posture

Exposed cloud storage

Leaks in pastes and repositories

Subdomain takeover risk

AI dataset exposure

AI bot blocking

Certificate Transparency subdomains

Vendor breach exposure

Reputation

Brand protection and typosquatting

Threat intelligence

Compliance

security.txt file

Compliance signals

Advanced AI Agent Readiness

robots.txt file

What the scanner checks, control by control

Is your domain ready for AI agents?

What Starter covers

What Pro adds on top