Type a domain above to list its subdomains, including domains that use Cloudflare. The names come from crt.sh, the public log of SSL certificates. On Cloudflare some will be missing. Its free certificate covers example.com and *.example.com, so blog.example.com stays hidden unless it gets a certificate of its own.
How to use it
- Type the domain without https:// or a path, such as example.com.
- Run the search. You get each subdomain the logged certificates name, sorted and without duplicates.
- Check each name against what you expected to see. A subdomain you don't recognise may be an old test site or a service someone set up and forgot.
Why Cloudflare hides some subdomains
If a domain uses Cloudflare for its DNS, the Universal SSL certificate Cloudflare issues names example.com and *.example.com. The wildcard covers blog.example.com and shop.example.com without naming them, so the log has no record of those two names.
Names do appear when a subdomain gets a certificate of its own. Total TLS issues a separate certificate for each proxied hostname. Deeper names like a.b.example.com fall outside the wildcard, so they need Total TLS or an uploaded certificate, and those certificates list the names. A subdomain that was on another host before it moved to Cloudflare can also still show up from its older certificates.
From Cloudflare's SSL/TLS documentation and its Total TLS announcement, read in October 2026.
What it does not show
The tool reads certificate logs only. It doesn't look up DNS, so it can't tell you if a subdomain still resolves, which ones run through Cloudflare's proxy or what IP sits behind them. It can't read a domain's DNS records in Cloudflare either. A subdomain that never had a publicly trusted certificate with its name on it won't be in the list.
This subdomain finder is free with no signup. SearchBlueprint, who make it, sell SEO planning for websites: which searches each page should answer.