hostcloak.com · defensive only · LO ops glass

Stay off easy radar.

AI ships fast. Surfaces leak faster. HostCloak grades what the public internet can see, ranks what to quiet first, and keeps a live deck honest — without pentest theatre.

Free surface scan Sample report

Not a compliance certificate. Not a pentest. Authorized targets only.

Surface Guard

TLS, headers, loud ports, mail auth, obvious admin exposure — scored with a severity-ranked fix order.

Live Deck

CPU, RAM, disk, and IN/OUT bandwidth via an optional outbound agent. No root password. Sample · Trust.

Noise lens

Pro Deep classifies your host’s public IP server-side (GreyNoise). Optional opt-in email self-check stays on your account address only — never third parties.

How it works

Step 1

Name a host you own

DNS or public IP you control. No root password. Third-party boxes are out of scope.

Step 2

We read the public surface

Presence only: open ports, certificate, headers, obvious login pages on the internet.

Step 3

Grade + fix order

Posture grade and what to quiet first. Pro adds history, PDF, alerts, and Live Deck.

Sample report excerpt · illustrative · full SAMPLE
SevFindingFix order
High Admin-style HTTP service reachable on public address Bind localhost / private net; put behind VPN or reverse proxy auth
High SSH authentication surface broader than key-only baseline Verify key login, then disable password auth; enable fail2ban
Med TLS certificate expires within 21 days Renew / fix auto-renew; confirm HTTP→HTTPS redirect
Med Missing strong security headers on primary site Add HSTS (when ready), CSP baseline, frame protections

Pricing

Self-serve after magic-link sign-in. Free stays limited.

Free

$0 / limited

  • Surface Guard Free — short presence grade + fix order
  • 1 host · 1 successful scan / day
  • Browser report only
  • No Live Deck, history, or PDF

Try free scan

Pro

$19 / month

  • Surface Guard Deep — agent/panel ports, leak paths, cookie/header pack
  • Live Deck + signal lost · CPU/RAM/disk/IN-OUT
  • Email alerts + history + PDF
  • ~5 hosts · higher scan cadence

Start Pro

Agency

$49 / month

  • Everything in Pro (same Deep engine)
  • More hosts under one account
  • White-label PDF for client boxes
  • ~25 hosts to start

Start Agency

FAQ

Is this a pentest or compliance certificate?

No. We report what is visible and what to tighten. We do not prove exploitability or ship attack procedures. A grade is not PCI, SOC 2, or an audit letter.

Do you need my root password?

Never. The optional Live Deck agent uses a per-host bearer token — outbound heartbeats only, revoke anytime. See Does / Does not.

What may I scan?

Systems you own or have written authorization to assess. Third-party networks are prohibited and close the account. Acceptable use.

How does Live Deck work?

Pro/Agency agent sends CPU, RAM, disk, and net counters. Gauges plus IN/OUT history — not DPI. Install after Enroll in the app. Sample.