hostcloak.com · defensive only · presence / hygiene

Surface report

A calm posture snapshot: what is reachable from the public internet, what is misconfigured, and the order to quiet it. Not a pentest. Not a compliance certificate.

Overall grade
C
Two high-hygiene items still loud
Host
demo.example.net
Target (customer-supplied)
demo.example.net
Scan
Illustrative · 1 Sep 2026, 9:00 AM PT
Findings
7 recorded · mail checks skipped (no MX)
2 High 2 Med 1 Low 2 Info

Live Deck metrics are not part of this sample. Agent heartbeats ship later.

Findings

SAMPLE excerpt · presence facts only · no exploit notes
Sev Finding Evidence (presence) Fix order
High Exposed login surface on public HTTP A login-style page is reachable at /admin on the public site. Bind the admin app to localhost or a private net; put it behind VPN or reverse-proxy auth.
High SSH authentication surface broader than key-only TCP 22 is reachable from the public internet. Handshake metadata indicates password authentication is offered. Confirm key login works, then set PasswordAuthentication no in sshd_config. Consider fail2ban and an allow-list of admin users.
Med TLS certificate expires within 21 days Certificate notAfter is 22 Sep 2026 (21 days from this illustrative scan). Renew / fix auto-renew. Confirm HTTP→HTTPS redirect after the new cert is live.
Med Missing strong security headers on primary HTTPS Primary HTTPS response has no HSTS, CSP, X-Frame-Options, Referrer-Policy, or X-Content-Type-Options. Add HSTS when HTTPS is stable, a CSP baseline, and frame / MIME protections.
Low HTTP does not redirect to HTTPS TCP 80 is reachable and the HTTP response does not send a 301/302 to the HTTPS origin. Redirect all HTTP to HTTPS once the certificate is healthy.
Info TCP 22 is reachable from the public internet Port 22 accepts a TCP connection from the scanner. Expected on many VPS hosts; scored as presence, not a finding of compromise. Keep SSH if you need it. Prefer key-only (see High item). Optional: restrict source IPs if your operator workflow allows.
Info SSH banner present Server sent an SSH protocol identification string. Recorded as inventory, not a vulnerability. Optional hygiene: a generic banner. Not required for a healthy grade.

Prioritized fix order

  1. Take admin HTTP off the public address. Bind to localhost or a private interface; reach it over VPN or a reverse proxy that requires your identity. Do this before polishing headers.
  2. Close the SSH password path. Verify you can log in with keys, then set PasswordAuthentication no in sshd_config and reload sshd. Add fail2ban if you have not already.
  3. Renew the certificate and confirm auto-renew is actually firing. Then turn on HTTP→HTTPS redirect.
  4. Add headers on the primary site: HSTS (only after HTTPS is solid), a conservative CSP, X-Frame-Options or CSP frame-ancestors, Referrer-Policy, X-Content-Type-Options.
  5. Leave 22 alone unless you do not need SSH from the internet. An open admin port is normal on a VPS; password auth on that port is the loud part.

Checks skipped

mail.spf, mail.dkim, mail.dmarc — skipped because this host has no MX records. Mail authentication is only scored when the name is also used as a mail domain.

Live Deck (CPU / RAM / disk / net) — not in this SAMPLE. Metrics require the optional host agent and a Pro plan, later in the ship order.

HostCloak reports presence, misconfiguration, and hygiene. It does not prove exploitability, does not issue certificates, and does not replace a pentest. Scan only hosts you own or are written-authorized to assess.