What gets scanned
A standard set of external checks, run against the deployments you attach. Nothing aggressive runs without your say.
External vulnerability scanning for the apps you deploy
MopokeHQ scans your deployed apps from the outside, the way an attacker sees them: ports, TLS, known vulnerability templates and OWASP ZAP. Each target is attached to a deployment, so findings land next to the code and dependency findings for the same app.
- Port discovery
- What is listening on the target
- Vulnerability templates
- Checks for known issues in exposed services
- TLS configuration
- How TLS is set up on each endpoint
- ZAP baseline
- A passive web scan that does not attack the app
- ZAP active
- Opt-in only, inside a window you set
Ownership first
Before any active scan, MopokeHQ checks that you control the target, with a DNS TXT record or a file under /.well-known. Until then it gets passive TLS and header checks only. Nobody can point MopokeHQ at someone else’s site and run an active scan.
- Unverified
- Passive TLS and header checks only
- Verified by DNS TXT
- Templates, ZAP baseline, ZAP active if you opt in
- Verified by /.well-known
- Templates, ZAP baseline, ZAP active if you opt in
Schedules and scan windows
Light checks run often. Heavier ones run less often. Active scans run only when you say they can.
Every request identifies itself with the User-Agent “MopokeHQ external scan”, which links to a page that tells a site’s owner what the traffic is. Fixed source addresses for firewall allowlists are coming.
- Daily
- Passive checks
- Weekly
- Vulnerability templates
- In your window
- Active scans
- Source
- Identified by User-Agent; fixed addresses coming
Findings in the same workflow
External findings get the same treatment as everything else in MopokeHQ, so there is one list to work from and one log to show.
How it works- A P1, P2 or P3 priority with an SLA.
- A line on the Now roadmap.
- Closed when the fix is seen deployed.
- Recorded in the append-only, hash-chained evidence log.
For agencies scanning client sites
Targets attach to deployments, and deployments sit under the client and project they belong to. Ownership checks and scan windows keep you inside what each client has agreed to.
MopokeHQ for agenciesWhat it does not do
No internal network scanning. MopokeHQ never connects into customer networks. Targets are the deployments you attach, not a sweep of everything you own.
If you need internal or network-wide scanning, a dedicated scanner may suit you better.
HostedScan vs MopokeHQQuestions
What is the difference between internal and external vulnerability scanning?
An external scan tests what is reachable from the internet. An internal scan runs inside your network and sees hosts the internet cannot. MopokeHQ does external scanning only, because it never connects into customer networks.
How do I run a vulnerability scan on my website?
Add the site as a target in MopokeHQ, attach it to a deployment, and verify ownership with a DNS TXT record or a file under /.well-known. Passive checks run on unverified targets; active scans wait for verification.
Is an OWASP ZAP active scan safe to run on production?
An active scan sends attack payloads, so it can change data or load the app. MopokeHQ runs ZAP active scans only when you opt in, and only inside the scan window you set.
Can I scan a site I do not own?
Not actively. Until ownership is verified, a target gets passive TLS and header checks only.
Where do MopokeHQ scans come from?
From MopokeHQ’s servers in Sydney. Every request carries the User-Agent “MopokeHQ external scan”, so you can tell our traffic apart from anyone else’s. Fixed source addresses for firewall allowlists are coming, and will be listed at mopokehq.com/scanner.
Put a mopoke on night watch
One job in your CI pipeline. Your first SBOM is matched against every advisory we hold within minutes.