Website exposure check: subdomains, takeover and exposed keys
A website exposure check shows what anyone can learn about your website and domain from public sources: how many and what kinds of subdomains certificate logs reveal, DNS records pointing to cancelled services (subdomain takeover risk), secret keys in the page code and typo domains in your name. WebMeter checks it for free and passively, without trying to break into anything.
What website exposure means
Certificate Transparency (CT) logs
Every publicly trusted HTTPS certificate is recorded in public logs. Chrome requires this for certificates issued after 30 April 2018. The log also contains the subdomain name, such as test., db. or vpn., and anyone can read it.
Dangling DNS and subdomain takeover
A dangling DNS record is an alias (CNAME) or a subdomain delegation pointing to a service or domain that no longer exists. Whoever sets up the cancelled service again takes over your subdomain (subdomain takeover) and runs their own content at your address, complete with valid HTTPS. Preventing it is simple: remove the DNS record on the same day as the service. Domain expiry, DNSSEC and name servers are covered by the domain and DNS check.
Website code
Every visitor downloads the HTML and JavaScript. Whatever ends up in them, such as a key to a paid service, is public. External scripts and who the website sends data to are covered by the guide to third parties on your website.
Why website exposure matters for a small business
Automated bots read these sources continuously, looking for easy targets such as a forgotten test version of the website. This isn’t a targeted attack on your company but mass scanning of the internet.
Whether the NIS2 cybersecurity rules apply to your company and what they mean for your website is explained in a separate guide.
Common website exposure problems
| Finding | Risk | Remedy |
|---|---|---|
| A forgotten test or old version of the website on a subdomain | Bots find it in certificate logs; it often gets no updates. | Switch off the unused version or restrict access to it. |
| A database admin tool, remote desktop or internal system reachable from the internet | Attracts automated login attempts. | Move it behind a VPN or firewall. |
| A cancelled e-shop or cloud service whose CNAME record remained in DNS | Subdomain takeover: someone else’s content at your address. | Delete the record; remove DNS when cancelling a service. |
| A key for a payment gateway, e-mail or AI service in the website’s JavaScript | Anyone can use it at your expense, for payments or sending e-mails. | Revoke the key, issue a new one and keep it on the server only. |
| A Google API key for maps without a domain restriction | Another website can use it at your expense. | Restrict the key to your domain and the APIs it needs. |
| A typo domain in your name with a mail server | Fake invoices and e-mails that look as if they came from you. | Consider registering the main variants; report a fraudulent domain to its registrar. |
The remedy is usually a task for whoever runs your website, hosting or DNS.
Subdomains and secret keys: what we check
The check is passive: WebMeter reads public sources and what the website itself sends to every visitor. It doesn’t try to break into anything.
- Subdomains from CT logs (crt.sh, with Cert Spotter as a fallback), only from valid certificates. Based on the name it sorts them into types such as database, remote administration, internal administration, ERP, mail, development and test. For at most 25 names it verifies in DNS that they still exist. The sorting is based on the name only and doesn’t confirm that the service is reachable from the internet. The public report shows only counts per type, not full names.
- Dangling records: an alias (CNAME) to a target that doesn’t exist in DNS, and a subdomain delegated to a name server on a non-existent domain. It reports them only on a definite DNS answer.
- Secret keys in the homepage HTML and in at most 8 JavaScript files from your domain. It looks only for keys with a fixed provider format (for example Stripe, AWS, GitHub, Slack, OpenAI or a private key). It never uses or stores a key; the report shows only its masked beginning.
- Lookalike domains: up to 40 variants (different ending, typo, similar-looking character), DNS queries only. Domains with the same name servers or address as yours are not counted.
WebMeter is neither a penetration test nor a vulnerability scanner: it doesn’t try passwords or known flaws, doesn’t fill in forms and doesn’t scan ports. Checks started from webmeter.eu don’t try admin addresses and don’t look for files such as .git or .env on the server. It doesn’t connect to subdomains or lookalike domains, so it doesn’t see what runs on them. Outdated versions of the content management system and PHP are rated by the CMS, WordPress and PHP check.
What the result looks like is shown in the sample report, in the Exposure area.
Website exposure check for free
Enter a domain and see what public sources reveal about your website, together with the other areas.
Not sure what to make of the result? We offer a no-obligation consultation. Just write to kontakt@webmeter.eu.
Website design that reveals no more than it should
An old website often leaves behind test subdomains, forgotten DNS records and keys in the page code. We build a new website from scratch without them, with e-mail and domain security set up. Before handover we run it through the same check as here.
How website design works → Case study: from 73 to 97 points →
FAQ on website exposure
Is this a website vulnerability check or a penetration test?
No. WebMeter only passively reads what is publicly available about the website and doesn’t try to break into anything. A penetration test is carried out by a specialist with the owner’s consent and actively tries what can be misused. WebMeter’s result therefore doesn’t mean that the website has no vulnerabilities.
How do I find all subdomains of my domain?
The complete list is in the DNS zone settings held by whoever manages your domain. Subdomains with a public HTTPS certificate are also listed in the public Certificate Transparency logs, which anyone can read. WebMeter knows them from there too and checks in DNS which still exist. The public report shows only counts per type.
Does WebMeter store the secret keys it finds?
No. The full value is kept in memory only briefly during the check. The report states the type of key and its masked beginning, and the key is never tried. Treat a key that was found as exposed, because anyone could have read it from the page code: it needs to be revoked at the provider and replaced with a new one.
Can someone send fraudulent e-mails from a domain similar to mine?
Yes. Anyone can register a domain with a typo or a different ending and set up a mail server on it. WebMeter checks up to 40 variants and lists those that probably aren’t yours, including whether they have a mail server. Often, though, another company holds them legitimately. The SPF, DKIM and DMARC check verifies the records that protect your own domain from spoofing.
Other areas checked
- SEO checker
- What is SEO
- SSL certificate check
- SPF, DKIM and DMARC check
- Website speed
- Cookies and GDPR on your website
- Security headers
- NIS2 and your website
- Competitor comparison
- AI search
- Website accessibility
- Third parties on your website
- Domain and DNS check
- CMS and technology
- Company and e-shop
- Search engines beyond Google
- Overview of everything WebMeter checks
How the check treats your website is described on the page about the WebMeterBot robot; what is stored and for how long is in the data processing policy.