Exposed subdomains
Subdomains are addresses like "mail.yourdomain.com" or "dev.yourdomain.com". This check lists active subdomains that respond, giving a pictu…
Analyse my site for freeUnderstanding "Exposed subdomains"
A subdomain (such as mail.yoursite.com or dev.yoursite.com) is a distinct address attached to your main domain, often used to isolate a test environment, a webmail service, an API, or a third-party service. Over time, organisations commonly accumulate dozens of subdomains created for one-off needs — a demo environment for a client, an old migrated site, an internal tool — some of which end up forgotten, never decommissioned, and never audited to the same standard as the main site.
This check is not a security alert in itself: discovering active subdomains is informational, giving you a picture of your infrastructure's actual exposure surface, often broader than what one would naturally assume.
How TheSiteFuse checks "Exposed subdomains"
TheSiteFuse attempts a DNS resolution for 14 common subdomain prefixes: www, mail, ftp, dev, staging, api, admin, blog, shop, test, beta, old, cpanel, webmail, prefixed to the root domain (without the leading www.). Every prefix that actually resolves to an IP address is listed in the result. This check is purely informational — it does not test the security of what is hosted on these subdomains, only their existence.
Why "Exposed subdomains" matters
- Less secure test environments — a
dev.orstaging.subdomain often runs with copied production data, but without the same protections (no WAF, default credentials, unpatched software versions). - Subdomain takeover — if a subdomain points to a third-party service (static hosting, SaaS platform) that was decommissioned without removing the DNS record, an attacker can sometimes claim that service and publish malicious content under your own domain.
- Shadow IT — subdomains created by different teams without central coordination often bypass the organisation's standard security process.
- Expanded attack surface — every active subdomain is a potential additional entry point; the more there are, the higher the odds a security audit misses one.
Fix "Exposed subdomains" step by step
Step 1 — Build a full inventory
Beyond the 14 common prefixes tested by this audit, use a more exhaustive subdomain discovery tool such as Subfinder or Amass, or check certificate transparency logs via crt.sh (Let's Encrypt SSL certificates are published in public logs, revealing every subdomain that has obtained a certificate).
Step 2 — Decommission what's no longer used
For each discovered subdomain: identify its owner/purpose, and if obsolete, remove both the hosted service and the corresponding DNS record — forgetting this second step is the main cause of subdomain takeovers.
Step 3 — Secure what remains active
Every legitimate subdomain still in use (dev environment, API…) should get the same level of protection as the main site: HTTPS, access restriction if not meant to be public, regular updates, and inclusion in the scope of recurring security audits.
Reference resource
To deepen your understanding of the technical concepts behind this check, see the dedicated Wikipedia article.
Wikipedia — Exposed subdomainsDoes your site pass this check?
Run the free full audit (120 checks) and instantly discover what needs fixing.