How to tell if your website is exposed or compromised

By the zmam.ai team ·

On this page

There is a useful distinction buried in the question “is my site secure?” Exposed means an attacker can see a way in. Compromised means they already took it. You can learn a surprising amount about both from outside the building — which is exactly where the attacker is standing.

The recurring lesson of the past two years is that breaches rarely begin with inside knowledge. They begin with reconnaissance of the public surface: an expired certificate, an unauthenticated mail domain, a forgotten subdomain, an exposed admin panel. The CitrixBleed 2 campaign hit internet-facing appliances eleven days before a public exploit even existed. The Hazy Hawk group turned the CDC’s own forgotten DNS record against it. None of that required getting inside first.

Signs you are exposed

Signs you are already compromised

If you see signs of an active compromise, treat it as an incident: preserve logs, isolate the affected system if you can, and bring in someone who does incident response. Do not quietly “clean it up” and move on — attackers leave more than one door.

What you can check yourself

From the outside you can review your certificate, your DNS and mail authentication, your HTTP security headers, and which subdomains and services are publicly reachable. Those signals together are your external attack surface — see What is external attack surface management?

How zmam.ai helps

zmam.ai runs an external, non-intrusive review of your public configuration — DNS, TLS, HTTP security headers, and mail authentication — and emails you a plain-language report of what is worth fixing. It never tests passwords, submits forms, or changes anything; it only reads what is already public. Deeper checks, such as port and service discovery and known-vulnerability lookups, are in development.