hostcloak.com · defensive only · guides
Letter grades are easy to chase and easy to misunderstand. A grade without priority turns into random header tweaks while something louder stays public on the same IP.
HostCloak’s free pass is built for people who want both: a posture grade and a severity-ranked fix order on a host they own.
Authorized hosts only. Not a pentest. Not a compliance certificate. No root password.
HostCloak Surface Guard reads a DNS host or public IP you control:
Free: $0 · 1 host · 1 successful scan/day · browser report. No root password.
SecurityHeaders and Observatory-style tools are strong when you want a header letter. HostCloak overlaps on headers, then grades the wider public host surface and tells you what to quiet first. Use header tools for header-only jobs; use HostCloak when you need grade + order for the box behind the site.
It is HostCloak’s defensive posture grade — useful for operators, not a compliance credential. We say that on purpose.
Sign-in is Google or magic link at /login when the product flow asks. Billing (Pro $19/mo, Agency $49/mo) is Stripe inside /app.
Working the fix order: quiet exposure, fix TLS hygiene, strengthen headers when ready, then re-scan within Free limits.
Next step: name a DNS name or public IP you own at /scan. Quiet what's loud on a host you own.
Defensive posture only — presence, hygiene, and fix order. Not a pentest. Not a compliance certificate. HostCloak never asks for a root password. Scan only hosts you own or have written authorization to assess.