Attack Surface: What's Exposed and Who Counts It
Your site is more than your homepage - subdomains, DNS, mail, endpoints, third parties. What attack surface means and how to map yours for free.
Short answer
Attack surface is every point where an untrusted party can interact with your systems: apps, APIs, subdomains, mail, DNS, buckets, admin panels. Map it, then shrink what you forgot.
Free mapping steps
List DNS records, run a passive website grade, check mail auth, review cloud public assets.
An hour of mapping beats a month of hardening the wrong host.
Readers skimming attack surface explained often stop at definitions. The part that prevents incidents is the verification step after the change - and the habit of re-checking after the next deploy that touches the same layer.
Shrink loop
Every quarter, delete what you no longer need. Forgotten surface is free attacker inventory.
Deprecation is a security control. Shipping is not the only way to reduce risk.
Common failure mode for attack surface explained: staging looks fine, production still serves the old config because a CDN, load balancer, or second vhost was never updated. Always verify the hostname customers hit.
Ownership
Every public asset needs an owner or a deletion date.
Ownerless subdomains and buckets are how incidents start with "we did not know that was still live."
If this section on attack surface explained becomes a recurring ticket, automate the check. Manual one-offs rot; a post-deploy assertion or weekly grade keeps the control honest.
What to do this week
- Export DNS + list public cloud assets.
- Run a passive grade on primary hosts.
- Mark each asset with owner or delete-by date.
- Delete one forgotten asset this week.
Your homepage is not the whole product.
Update log (1)
2026-07-07Editorial form rewrite for length and uniqueness.
Sources + verification
Practical guidance based on mainstream browser behavior, common reverse-proxy configuration, and widely published RFCs and vendor docs. Verify on your own stack with curl, browser devtools, and a re-scan after each change.
