hostcloak.com · defensive only

See your VPS surface.
Close what’s loud.

Defensive posture grade, clear fix order, and optional live host metrics — without pentest theater or exploit kits.

Free surface scan Sample report

Not a compliance certificate. Not a pentest. Authorized targets only.

Surface Guard

TLS, headers, loud ports, mail auth, obvious admin exposure — scored with a severity-ranked fix order.

Live Deck

CPU, RAM, disk, and IN/OUT bandwidth via an optional outbound agent. No root password. Sample · Trust.

Noise lens

Optional later enrichment so SSH hammers look like background radiation — or something worth a closer look.

How it works

Step 1

Name a host you own

DNS or public IP you control. No root password. Third-party boxes are out of scope.

Step 2

We read the public surface

Presence only: open ports, certificate, headers, obvious login pages on the internet.

Step 3

Grade + fix order

Posture grade and what to quiet first. Pro adds history, PDF, alerts, and Live Deck.

Sample report excerpt · illustrative · full SAMPLE
SevFindingFix order
High Admin-style HTTP service reachable on public address Bind localhost / private net; put behind VPN or reverse proxy auth
High SSH authentication surface broader than key-only baseline Verify key login, then disable password auth; enable fail2ban
Med TLS certificate expires within 21 days Renew / fix auto-renew; confirm HTTP→HTTPS redirect
Med Missing strong security headers on primary site Add HSTS (when ready), CSP baseline, frame protections

Pricing

Self-serve after magic-link sign-in. Free stays limited.

Free

$0 / limited

  • Limited Surface Guard on hosts you own
  • Current grade + prioritized fix order
  • Browser report only
  • No Live Deck, history, or PDF

Try free scan

Pro

$19 / month

  • Working scan cadence + history
  • Email alerts + PDF export
  • Live Deck via host agent
  • ~5 hosts to start

Start Pro

Agency

$49 / month

  • Everything in Pro
  • More hosts under one account
  • White-label PDF for client boxes
  • ~25 hosts to start

Start Agency

FAQ

Is this a pentest or compliance certificate?

No. We report what is visible and what to tighten. We do not prove exploitability or ship attack procedures. A grade is not PCI, SOC 2, or an audit letter.

Do you need my root password?

Never. The optional Live Deck agent uses a per-host bearer token — outbound heartbeats only, revoke anytime. See Does / Does not.

What may I scan?

Systems you own or have written authorization to assess. Third-party networks are prohibited and close the account. Acceptable use.

How does Live Deck work?

Pro/Agency agent sends CPU, RAM, disk, and net counters. Gauges plus IN/OUT history — not DPI. Install after Enroll in the app. Sample.