Get a 0-100 hardening score for any Linux server in 60 seconds.
A scored hardening report you can read, share, and act on. Scan from the outside, run a script you can audit yourself, or let us connect — you decide how much access to give. No signup to start.
Sign in with a Starhold Account (Google sign-in) to save servers and keep reports. Scanning needs no account. Questions: hello@starhold.dev.
On the server, paste one line:
curl -fsSL https://stage-serverscanner.starhold.app/scan/script?autoupload=1 | sudo bash
Read-only, installs nothing, prints your score and a share link. Read the script first — it is the exact script being piped.
Three ways to scan — pick your comfort level
You stay in control. Start with zero access and go deeper only when you trust us. The on-box options return the same full 26-check report — the only difference is whether we ever touch your server.
External
No access needed
- You give just a hostname or IP
- We probe your public surface: open ports, exposed services, TLS & SSH ciphers, HTTP headers
- Nothing installed, nothing handed over
Run & upload
You keep the keys
- Download a short, read-only script for your OS — read every line before you run it
- Run it; results come back (auto-upload optional)
- We get the data, never access to your box
- Full 26-check report
Let us connect
Hands-off
- Grant a read-only SSH key
- We connect from our servers and run all 26 checks
- Nothing for you to install or run
- Full 26-check report
How it works
- Point it at a server. Give us a host (and, for the hands-off option, an SSH user and key). We read configs and run 26 hardening checks. For one-off scans we never store your credentials; a server you save to an account keeps its SSH key encrypted.
- Get a 0–100 score. Weighted by severity. Every deduction is named, evidenced, and remediated. Coverage is shown alongside the number.
- Share the report. Public scrubbed URL (target redacted) you can drop in a PR or Slack. $5 keeps it for 3 months (or until you delete it) and adds a PDF.
Scan from outside — no access needed
Give us a hostname or IP and we probe its public surface from our servers — TLS & SSH ciphers and HTTP headers for any host; open ports and exposed data stores once you verify you own the host. Nothing to install, no credentials. Only scan hosts you're authorized to test.
Before you verify, the report shows an outside-in score: a partial number from the few checks that can run from outside, labelled with how many ran. The full hardening score needs a verified host or a scan on the server itself.
Scan now — we connect (hands-off)
The managed option. Paste a read-only SSH key; we connect from our servers, run the checks, and discard the credentials when the scan finishes — they're held in memory and briefly written to a private temp file while connecting, then deleted.