The 10-Second Security Check (and What It Can't Tell You)

Most companies have never checked what they expose to the internet. You can do a meaningful first check in ten seconds — no signup, no scanner to install. Here's exactly what it covers, and just as importantly, what it can't tell you.

The 10-second check

Type your domain into the free check and three things happen at once:

• TLS. Does your site load over HTTPS with a valid certificate — and how many days of life does it have left? A certificate that expires on a Friday afternoon is an outage you scheduled yourself.
• Key ports. Seven of them: 21 (FTP), 22 (SSH), 25 (mail), 80, 443, 3306 (MySQL), 3389 (RDP). For a typical business, the only ones that should be open are 80 and 443 — maybe 25 if you run your own mail.
• Security headers. HSTS and Content-Security-Policy. Two lines of configuration that stop whole classes of attacks, missing from most small sites.

Ten seconds. External only — nothing is installed, nothing touches your network.

Why those three

Because they're where the boring breaches start. An attacker doesn't need a zero-day; they need something reachable.

RDP (3389) open to the internet is one of the most brute-forced services in existence — and it's usually a laptop or a server someone forgot to put behind a VPN. FTP (21) and MySQL (3306) open means credentials or data are one dictionary attack away. I've seen both on companies with fewer than 20 employees — not because anyone was careless, but because nobody had ever looked.

The certificate check catches the other quiet failure: the site that's "fine" until it isn't. If your cert has 12 days left and nobody on the team knows, that's not a finding — it's a countdown. Leaf-only expiry checks lie to you; the free check at least tells you where you stand today.

What it can't tell you

This is the part most "free scan" tools skip, so I'll be straight with you:

• Vulnerabilities. An open port is a door. The check tells you the door exists — not whether the lock on it (the software behind it) has a known CVE. That needs a real vulnerability scan: Nuclei's 9,000+ templates plus the OpenVAS database.
• The forgotten subdomains. staging.yourcompany.com, shop2.yourcompany.com — old software with no one watching. They show up in Certificate Transparency logs, and the quick check doesn't review each of them.
• Intent. A port being open isn't automatically a problem — sometimes it's the mail server, and that's fine. Someone has to know what each open port is for.
• The inside. This is an external check, like a visitor or an attacker would see it. Your internal network, your backups, your MFA — different conversation.

The right order

Ten seconds first. If the quick check comes back clean, you've ruled out the most common failures for free — and you know your baseline. If it finds something, fix the obvious (close the port, renew the cert) and then decide: do I want to know what's behind those doors?

That's the full Security Health Check: every port and subdomain, a real vulnerability scan, and a one-page report with each finding rated and given a one-line fix. €390, five business days.

And if you'd rather not re-check by hand every month, RiskiBits Monitor runs the same checks daily and only emails you when something critical changes. From $29/month.

One number to remember

80/443 should be your only open doors. Every extra port is another lock to maintain. If you can't explain why a port is open, close it — then run the ten-second check again and confirm.