DDoSExposure Check
The free reading tells you what your domain already says to the internet, without sending it a single packet. What it cannot tell you is whether your defences hold — and that is the question worth answering.
What the free check cannot tell you
- Whether your defenses actually hold. Configuration visible from outside is not behaviour under load. The interval between an attack starting and mitigation engaging is the number that decides an incident, and nothing short of a controlled test produces it.
- Whether your origin is reachable directly. That is the finding most worth having and the one most useful to an attacker, so we do not hand it to anonymous visitors. It needs proof that the domain is yours.
- Whether your rate limits work. Most rate limiting is deliberately silent. Its absence from a response header means only that it is not being advertised, and establishing the real threshold requires measurement, with permission.
- Anything that only exists in a live response. Security headers, cache behaviour, whether the site answers at all. We read public records and never contact your servers, so these are unavailable to us by choice rather than missing by accident.
For what a controlled test measures instead, see DDoS testing and the test plan that governs one.