How the subdomains check works

Most domains have more than one website: a shop, a blog, a staging copy, a customer portal. A forgotten staging site is often where the problems are, because nobody looks after it. This check is part of the extended check, which you unlock by confirming an e-mail address on your domain. It finds the other hosts under your domain and checks each one the same way as your main site.

What it reads

Where the host names come from. Nothing is guessed: we never try a list of common names.

• The names in your site's certificate, and hosts your pages link to. The standard check uses these too.
• Certificate Transparency logs. Every publicly trusted certificate is recorded in public logs. We ask the public search service crt.sh which names under your domain appear there. That question goes to crt.sh, not to your site.

What each host gets. Up to 30 hosts are checked. Hosts named like mail servers (mail, smtp, imap, mx, autodiscover, webmail) go to the end of the list. Each host first gets one request over https. On each host that answers, the same checks as on your main site run:

• response headers,
• the TLS certificate and protocols,
• the standard list of well-known files that should not be public,
• one request to a page that cannot exist, to see the error page.

Each host has its own request budget, so one large host cannot use up the check for the others.

What it reports

The same findings as the checks above. Each one names the host it was found on. Your report's Subdomains section lists every host we looked at, with:

• whether it answered over https,
• its certificate issuer and expiry date,
• how many findings it has.

What it cannot see

• Hosts that have never had a publicly trusted certificate and are not linked from your pages. Many internal names fall into this group.
• Hosts that answer only over plain http, or only on other ports.
• Anything behind a login, as with every passive check.
• When crt.sh does not answer (it is a free service with no guaranteed uptime), the report says so. In that case the hosts come from your certificate and pages only.

What to do with the result

Go through the host list with your developer. A host you no longer need is best switched off and removed from DNS. For a host you keep, fix its findings the same way as on your main site. A staging or test copy should not be reachable from the internet without a login.