FALKEN'S MAZE / HOW IT WORKS

How it works

Falken's Maze is a security scanner for domains. Give Joshua, the scan engine, a domain name and it checks the settings attackers look at first: who may send mail as you, whether your DNS and certificates can be trusted, and whether your site sends the headers that blunt common attacks. The results roll up into one grade, the Maze Score, with a plain-language fix for everything that's wrong.

1. The scan

Joshua runs 42 checks across email authentication, DNS, TLS and security headers, and on paid plans subdomains, blocklists and WordPress. A free scan reads public information only: the domain's DNS records, its certificate and its home page, the same things a browser or a mail server sees. It takes about a minute.

• No logins, no password guessing, no exploits.
• Checks that look harder at a site, such as listing WordPress usernames, only run on domains whose owner has proved control.
• Private and internal addresses are never scanned.

See every check and what it looks for.

2. The Maze Score

Each check is worth a number of points, weighted by how much it matters. A pass earns the full weight, a warning earns half and a failure earns nothing. Checks that couldn't run are left out rather than counted against you. The Maze Score is the share of points earned, from 0 to 100:

A

90–100

B

80–89

C

70–79

D

60–69

F

below 60

3. The fixes

The report lists failures first, then warnings, with the biggest point losses at the top, so the first fix is the one worth the most. Each one says what Joshua found, why it matters and what to change, usually down to the DNS record or header to add. The free report shows how to fix the top issues; leave an email address to unlock the rest.

4. Keep watching

Settings drift: a certificate stops renewing, a new mail service gets added without updating SPF, a forgotten subdomain starts pointing at nothing. With an account, Joshua rescans your domains on a schedule and emails you when a check starts failing, the grade falls or the score drops.

Plans

Your first 7 days on a paid plan are free. Add a card when you choose the plan and you won't be charged until the trial ends. Cancel before then and you pay nothing. The trial is for accounts that haven't had a paid plan before.

Add-on: Plugin Recon, $15/mo on paid plans. WordPress audit: core version, visible plugin versions checked against WordPress.org, user enumeration, XML-RPC and exposed files.

Is it allowed?

Run the free report card on any domain; it only reads what's public. Paid checks, monitoring and anything more intrusive are for domains you own or may test. See the Acceptable Use Policy.