Infrastructure
CDN / WAF coverage, DNS, hosting signals, and edge configuration health.
How your site is exposed and protected at the network edge.
Port and service exposure
| Check | Passes when |
|---|---|
| Only 80 / 443 exposed | No other ports reachable |
| No database ports exposed | 3306, 5432, 27017 all closed |
| No admin ports public | 22, 23, 3389 firewalled |
An internet-reachable database port is one of the highest-severity findings FlawPilot reports. Databases should be reachable only from your application network, never from the public internet.
Subdomain hygiene
| Check | Passes when |
|---|---|
| No dangling CNAMEs | Zero subdomain-takeover candidates |
| Subdomain enumeration reviewed | Discovered subdomains accounted for |
A dangling CNAME is a DNS record still pointing at a deprovisioned host. Any attacker who claims that host now serves content on your subdomain - with your name and, depending on cookie scope, your users' sessions.
Cloud storage exposure
| Check | Passes when |
|---|---|
| No public S3 / GCS / Azure buckets | Zero publicly listable buckets |
| No world-writeable buckets | All buckets read-only or private |
A world-writeable bucket lets anyone overwrite assets your site serves - which means arbitrary script execution on your own domain.
Edge protection
| Check | Passes when |
|---|---|
| WAF detected | A web application firewall is identified |
| CDN in front of origin | CDN headers present |
A CDN and WAF absorb traffic before it reaches your origin, which both improves performance and blunts common attack traffic.
FlawPilot notes that a port answers or a bucket lists publicly. It never connects to a database, reads bucket contents, or attempts a takeover.