Observed arrival · 2026-10-23
SurfaceWatch checks six layers of website security
A Chrome extension that presents an A–F security grade for a website and copy-paste fixes for issues it finds.
○Open
⊠Login
$Paid
†Ads
✦Pretty
●Pro
◎Niche
◉Human
⚑Risk
ƒJS
- For
- Web studios and site owners managing client websites
- Worth noticing
- Its sample flags admin, staging, and Jenkins subdomains found through public certificate logs.
Field notes
The report format groups findings by security area and severity, with examples such as missing browser security headers, cookies lacking HttpOnly, and a permissive DMARC policy. For attack-surface checks, the page says it uses public certificate logs to flag subdomains such as staging or Jenkins. It describes the checks as passive and says no account is required to start.
Observed signals
Read the marks
Editorial observations of this landing page, not a rating.
○OpenPublic substance visible
$PaidCommerce or pricing visible
✦PrettyNotable craft visible
●ProPolished or operationally mature
◎NicheUnusually specific use
ƒJavaScriptBrowser-side code central
One card from the complete issue