Criticalport-3306
Port 3306 (MySQL) is open to the internet
MySQL should never be reachable from the internet; it is a common way in for attackers and ransomware.
Fix Close port 3306 in the firewall or bind the service to localhost/VPN only.
Sample report
This is what you get — every day.
A real Monitor report for a fictional company, acme-logistics.example: the score and its trend, every finding with the exact fix, the technical evidence behind it, and the alert email that lands in your inbox when something changes.
acme-logistics.example
Checked 24 Oct, 16:59 UTC · needs attention · 1 critical change since yesterday
Security score
Top priorities
50/100
1 critical2 warning6 info4 passed
25 Sept 202624 Oct 2026
- CriticalPort 3306 (MySQL) is open to the internet
- WarningThe TLS certificate expires in 12 days
- WarningHSTS header missing
Technical details
| HTTPS | OK (HTTP 200) |
|---|---|
| HTTP → HTTPS | Redirects |
| Certificate | 12 days left |
| Open ports | 80 HTTP, 443 HTTPS, 3306 MySQL |
| Missing headers | strict-transport-security |
| Server | nginx/1.18.0 · PHP/7.4.33 |
| SPF | Present (~all) |
| DMARC | p=none |
| DKIM | |
| MX / MTA-STS | MX present · No MTA-STS |
| DNSSEC / CAA | DNSSEC off · No CAA |
| security.txt | Missing |
| Domain expiry | 211 days left |
| Subdomains (CT logs) | 9 |
Critical — fix now
Warnings — fix soon
Warningcert
The TLS certificate expires in 12 days
If renewal fails, browsers will block the site.
Fix Confirm automatic renewal works, or renew manually this week.
Warninghsts
HSTS header missing
Browsers may connect over plain HTTP first, where traffic can be intercepted.
Fix Send Strict-Transport-Security: max-age=31536000; includeSubDomains.
Improvements
Infotech
The server reveals its software version
Server header: nginx/1.18.0 · PHP/7.4.33. Version numbers help attackers pick exploits.
Fix Hide version details in the web server configuration.
Infodmarc-none
DMARC is monitoring only (p=none)
Spoofed mail is reported but still delivered.
Fix After a few weeks of clean reports, move to p=quarantine, then p=reject.
Infodnssec
DNSSEC is off
DNS answers for this domain cannot be verified, which allows some spoofing attacks.
Fix Enable DNSSEC at your DNS provider and add the DS record at your registrar.
Infocaa
No CAA record
Any certificate authority may issue certificates for this domain.
Fix Publish CAA records for the authorities you use (for example letsencrypt.org).
Infosecuritytxt
No security.txt
Researchers who find a problem have no official way to tell you.
Fix Publish /.well-known/security.txt with a Contact: line (RFC 9116).
Infosubdomains
9 subdomains seen in certificate logs
Every subdomain is part of your attack surface; forgotten ones are a common way in.
Passed
Passtls
HTTPS works
The site answers over HTTPS (HTTP 200).
Passspf
SPF record present
Receiving servers can check who may send mail for this domain.
Passdkim
DKIM signing found
Selectors: google.
Passdomain-exp
Domain registration is current
It expires in 211 days.
Subdomains in certificate logs (9)
api.acme-logistics.exampleapp.acme-logistics.examplecdn.acme-logistics.examplemail.acme-logistics.exampleportal.acme-logistics.exampleshop.acme-logistics.examplestaging.acme-logistics.examplestaging-old.acme-logistics.examplevpn.acme-logistics.example
The alert
One email when it matters.
No daily digest to ignore. When a check finds a critical change, you get exactly what changed and a link to the fix — to up to five addresses on Pro.
Critical: acme-logistics.example — 1 critical change
Today's check found changes that need your attention:
- CriticalPort 3306 (MySQL) is now open to the internet.
- WarningThe TLS certificate expires in 12 days.
- WarningNew subdomain in certificate logs: staging-old.acme-logistics.example.
Security score: 77 → 50/100
See the details and how to fix it →Run the same check on your domain.
Free for one domain, weekly. Daily checks from $19 a month.