CYHEXStart
Type a domain on the scan page. CYHEX runs seven checks in parallel and shows each one as it lands, usually in 15 to 25 seconds. Every report gets its own link, kept for 7 days, which you can share or print.
To keep watching a site, sign in on the dashboard with your wallet, add the site, and prove it is yours.
Passive by design
CYHEX reads only what a website already shows the internet. It opens the homepage once like a visitor, reads the certificate and public DNS records, and looks names up in public certificate logs and CVE databases.
- It never logs in, fills forms, guesses passwords, fuzzes or sends exploit payloads.
- It only connects to ports 80 and 443.
- It scans domain names only, never raw IP addresses, and refuses any name that points into a private network.
- Every redirect is checked again before it is followed.
The seven checks
| Check | What it reads |
|---|---|
| Certificate & TLS | Trust, expiry, the names it covers, key size, which TLS versions (1.0 to 1.3) are still accepted. Ends in a grade from A+ to F, or T when the certificate is not trusted. |
| Security headers | Twelve checks: HSTS, Content-Security-Policy, clickjacking (X-Frame-Options or frame-ancestors), X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, CORP, cookie flags, Server and X-Powered-By version leaks, open CORS with credentials. |
| Software & CVEs | Server, CMS and JavaScript library versions from headers and page HTML, matched against NVD (servers), OSV (npm libraries) and the CISA Known Exploited Vulnerabilities list. Server matches count one level lower, because Linux distributions often patch without changing the version number. |
| DNS & email | SPF, DMARC, DKIM at common selectors, CAA, DNSSEC. |
| Subdomains | Names from public certificate logs (crt.sh, with Cert Spotter as backup), and any that point to a deleted cloud resource someone else could claim. Verified owners get every subdomain opened and checked. |
| Blocklists | Whether Quad9, Cloudflare's malware resolver and Control D's malware resolver block the domain, and whether the server's IP is on Spamhaus DROP or abuse.ch Feodo Tracker. |
| Reachability | The redirect chain, HTTP to HTTPS, time to first byte, who owns the IP (RDAP), and any CDN or firewall in front. |
Grades
Each finding has a severity: critical, high, medium, low, info or pass. The overall score starts at 100 and loses 25 per critical, 10 per high, 4 per medium and 1.5 per low. A failed or untrusted certificate caps the score at 35. A+ is 95 and up, A 85, B 75, C 62, D 50, F below.
CLI
Everything the scan page does, from your terminal. No install needed, Node.js 18 or newer:
| Command | What it does |
|---|---|
cyhex recon <domain> | Runs the seven checks and prints each one as it lands, then the grade. --full lists every finding with its fix, --json prints JSON. |
cyhex patch <domain> | HEX-01 Patch: the scan in plain English and the exact fixes for your server. |
cyhex guard <domain> --cloudflare | HEX-02 Guardian: draft WAF rules for Cloudflare, nginx (--nginx) or ModSecurity (--modsecurity). |
cyhex kev | The newest vulnerabilities CISA confirmed exploited in the wild. |
cyhex report <id> | Prints a saved report. |
In CI
Fail the build when your grade drops: the command exits with code 2 when the grade is under the one you set.
The CLI uses the same free public API and the same limits as the website. Package: npmjs.com/package/cyhex.
AI reports
Read & Patch
Turns a report into plain English: how exposed the site is, what to fix first, and the exact config change for the server CYHEX detected (nginx, Apache, IIS, Caddy, Cloudflare and others). It only uses the findings in the report. Five free reports a day per visitor; a finished report is shared, so opening it again is free.
Guardian
Drafts firewall rules from a report for Cloudflare, nginx or ModSecurity. Every rule starts in a monitoring mode and comes with how to undo it. Nothing is applied for you: you review and paste.
Prove it is yours
Add the site on the dashboard and use either proof. The value is unique to your account and the site.
Option 1 · DNS record
Option 2 · a file
Verified sites unlock the deep scan and the agents. Proof lasts 30 days for the public deep scan, and as long as the site stays on your dashboard for the agents.
Agents
| Agent | Status | What it does |
|---|---|---|
| HEX-01 · Read & Patch | live | Explains a report and writes the fixes. |
| HEX-02 · Guardian | live | Drafts firewall and WAF rules from a report, for you to review and apply. |
| HEX-03 · Sentinel | live | Rescans verified sites every 6, 12, 24, 72 or 168 hours and reports what changed: new problems, fixes, grade moves. |
| HEX-04 · Hunter | live | Checks CISA's list every 6 hours; when new exploited CVEs appear, rechecks every verified site that shows software versions. Also warns when a site's server IP lands on Spamhaus DROP or Feodo Tracker. |
| HEX-05 · Chain | planned | For Web3 teams: checks the dApp frontend people sign from, and watches the contracts and wallets behind it. |
Agents prepare work only. Nothing changes on your servers, DNS or firewall unless you do it.
Alerts
Every alert lands in the dashboard inbox. Turn on browser notifications on the dashboard to get them on that device even when CYHEX is closed. They use the browser's own push service: no Telegram, Discord or email account is involved, and CYHEX never asks for an email address.
Threat map
The threat map shows public data, refreshed every six hours: botnet command servers by country (abuse.ch Feodo Tracker), hijacked and criminal netblocks by internet region (Spamhaus DROP), and the newest exploited CVEs (CISA). It is a picture of what is out there, not of attacks on your site.
Limits & privacy
- 8 scans per hour per visitor. The same site scanned in the last 10 minutes returns that report.
- 5 free AI reports and 3 Guardian drafts per day per visitor (10 when signed in).
- Reports are kept 7 days, except the latest report of a watched site.
- Accounts store your wallet address, your sites, your alerts and your browser's push address. No email, no name, no password.
- Use CYHEX on sites you run or have permission to check. Results are a starting point, not a full security audit.
$CYHEX
$CYHEX lives on Robinhood Chain via Pons. Part of what CYHEX earns buys $CYHEX back and sends it to the dead address; every burn is listed with its transaction. It is not affiliated with Robinhood. A meme token with no promise of value or returns; nothing here is financial advice.