What is an attack surface? Your website edition
The concept, without the jargon
Attack surface sounds intimidating, but it is a plain idea: it is every point where the outside world can touch your system. For a website, that means every door, window and mail slot a visitor — or an automated bot — could interact with. The bigger and more complicated that set, the more places something can be misconfigured. So the goal is not to make the surface scary, it is to make it small and well-understood.
What actually counts as surface
For a typical website, your attack surface includes more than the pages people see:
- Every reachable URL — pages, but also endpoints, admin paths, and old routes you forgot to remove.
- Every input — forms, search boxes, file uploads, query parameters, anything that accepts data.
- Your APIs — public and semi-public endpoints, including ones only your frontend is supposed to call.
- HTTP responses — the headers you send (or fail to send), which decide what browsers allow.
- Cookies and sessions — how identity is stored and whether those cookies are protected.
- TLS configuration — which protocol versions and ciphers your server accepts.
- Exposed files — config, backups, source maps and anything reachable by a predictable path.
- Third-party code — every script, widget and dependency you pull in extends your surface to include theirs.
Notice how much of this is invisible from the rendered page. That is the catch: your surface is larger than what you can see in a browser.
Why smaller is safer
There is no clever trick here, just arithmetic. Every endpoint is something to secure, every input is something to validate, every dependency is something to trust. Reduce the count and you reduce the number of things that can go wrong. A small, deliberate surface is not only safer — it is something you can actually hold in your head.
How to shrink yours
Shrinking the surface is mostly subtraction:
- Remove what you do not use. Old routes, unused endpoints, debug pages, dead widgets — delete them.
- Close what should not be public. Admin paths behind auth, config files out of served folders, source maps off production.
- Tighten what remains. Add the security headers, fix the cookie flags, disable old TLS, scope your keys.
- Account for third parties. Load only the scripts you need, and know what each one can do.
Most of these are one-time fixes that pay off permanently.
Measure before you manage
You cannot shrink what you have not mapped, and you cannot map your surface by browsing your own site — most of it does not show up on the page. An automated scan looks at your site the way an outsider would: reachable paths, headers, cookies, TLS, exposed files and third-party code, all in one view. Scan your site to see your real attack surface.