What bigWUF checks

Everything, in plain words. bigWUF only looks from the outside. It never logs into your systems, never tries a password and never changes anything.

Everything of yours that's on the internet

Most break-ins start with something the owner forgot about. bigWUF builds the list first, then checks each item.

Subdomains: Every name under your domain, from DNS, public certificate logs and search. Old test sites and forgotten portals are the commonest way in.
Your servers and where they are: Each server's address, provider, country and city, on a map. Shows data stored outside the EU and servers nobody remembers paying for.
Open services: Which doors answer on each server: remote desktop, databases, file sharing, admin panels. A remote desktop or database open to the internet is how most ransomware starts.
Devices and building systems: Cameras, recorders, routers, printers, and the controllers for fridges, heating, lighting and doors on your shops' and offices' internet lines. These were never built to face the internet. Anyone who reaches them can switch them.
Old and hidden: Former servers and addresses from DNS history and old links still pointing at you. Shadow IT: things set up outside IT's view that still carry your name.
Subdomain takeover: Names that point at a cloud service you no longer use. Someone else can claim that service and publish anything under your name.
Exposed files and panels: A short list of paths that should never be public: password files (.env), code folders (.git), backups. Bots ask every website for these paths every day.

Not every flaw matters. bigWUF puts the ones criminals are using right now at the top.

Vulnerabilities in your software: The software versions your servers announce, matched to published flaws (CVE numbers) and the type of weakness (CWE). Lets your IT provider look each one up and patch it.
Actively exploited holes: Each flaw checked against CISA's list of flaws used in real attacks and the likelihood-of-attack score (EPSS). These get fixed first, before anything else.
Risk level and fix: Every finding gets a level (critical to low), what an attacker would do, what it costs you, the fix, who should do it and how long it takes. So you can hand it to someone without translating it.
Website, certificate and encryption: HTTPS, certificate expiry, security headers, outdated website software. Visitors' logins and forms must not travel unencrypted.

Fake invoices and 'CEO' emails cost European small businesses more than any virus.

Email protection (SPF, DKIM, DMARC): Whether your domain tells the world's mail servers to reject fake email sent in your name. Without it, anyone can send an invoice from your exact address.
Mail server encryption: Whether your mail servers encrypt incoming mail and have valid certificates. Unencrypted mail can be read on the way.
Lookalike domains: Recently registered names that look like yours (yourcompany-invoice.eu, yourcornpany.eu), and whether they can send email. A new lookalike with a mail server is usually a scam being prepared.
Brand impersonation watch: New security certificates issued for website names containing your brand, from public certificate logs, and servers that show your website's icon without your name. Phishing sites need a certificate before they go live, so this often catches them early.
Clone alarm (tripwire): Tells you the moment a copy of your login page loads on someone else's address. Catches the phishing copy that is already live.

Attackers start with names and passwords that are already out there.

Leaked staff accounts: Which of your work email addresses appear in known data breaches, and which breach. Reused passwords from old breaches open new doors.
Email addresses on your website: Personal staff addresses published on your pages (shared ones like info@ are fine). Every published name is a phishing target and a password-guessing username.

Some problems mean someone else is already inside.

Botnet command servers: Your addresses checked against abuse.ch's list of servers controlling infected computers. A match means a machine of yours is likely compromised.
Hijacked networks: Your addresses checked against Spamhaus's list of networks taken over by criminals. Your provider may be hosting you next to attack infrastructure.
Blocklists: Whether your domain or servers are on public spam or malware blocklists. Listed servers often mean an infected site or a hijacked mailbox.
Attack map: Real attacks on your servers, from your own logs, on a map. See who is trying, from where, and against what.

Your accountant, IT company and maintenance firms hold your data and send you invoices.

Supplier checks: Public checks on each supplier's domain every week: email protection, website security, registration. A supplier that's easy to impersonate is where fake invoices to you come from.
Impersonation level: For each supplier: easy to fake, can be faked, or hard to fake. Tells you whose bank-detail changes to confirm by phone.
Message to send them: A polite, ready-to-send note listing what to fix. Most suppliers fix it once someone asks.

Scans show the open doors. Tripwires tell you when someone has already walked through one.

Secret link: An address nobody uses. Put it in a file called 'VPN passwords.txt'. If it's opened, someone is reading your files.
Word document: A file like 'Salaries 2026.docx' that reports when it's opened. Intruders go straight for money files.
Decoy login: A fake staff portal with a planted username and password. Using the planted password proves someone found your notes.
Clone alarm: An invisible pixel for your login page. If scammers copy the page, you learn the fake address.

One check is a photo. Monitoring is the security camera.

Scheduled re-checks: Everything above, re-checked every week (Path) or every day (Cottage and Huntsman). New problems appear when someone changes something.
What changed: Each check compared with the last: new problems, fixed problems, grade changes. You see what moved, not the whole list again.
Alert emails and the Monday summary: An email when something serious appears or a tripwire trips; a weekly summary of the rest. You don't have to log in to stay safe.