Terms of use

This service is operated by The service operator. By creating an account you accept these terms.

Service provider

1. Authorized use only

You may scan only domains that you own or that you have the written permission of the owner to test. Verifying a domain on this service does not replace that permission when you act for someone else. Scanning systems without authorization may be a criminal offence.

2. What the service does

The scan is read-only: it resolves public DNS records, queries public Certificate Transparency logs, WHOIS and blocklists, opens TLS connections, sends ordinary HTTP GET requests to the home page, to same-site pages it links to (up to 25), to a fixed list of well-known paths and to the public files of the WordPress plugins and themes in use, connects once to a fixed set of common TCP ports (reading the home page of an open control-panel port to identify it), and looks up disclosed software versions in public vulnerability and release databases. It does not exploit, brute-force or fuzz anything, and submits no forms. Scans are refused for hosts that resolve to non-public addresses.

2a. Free tools and monitoring

The free tools work on any domain without an account and read only what the domain publishes to everyone: DNS records, the MTA-STS policy, one request for the home page and a few TLS handshakes. Monitoring compares the software versions seen at your last scan with public vulnerability and release data, reads public DNS and WHOIS records, and opens one TLS handshake per verified domain to read its certificate.

3. Prohibited conduct

• Scanning a domain you are not authorized to test, or verifying a domain you do not control.
• Using the service to disrupt, overload or attack any system.
• Circumventing limits, sharing accounts to obtain free scans, or automating sign-ups.
• Automated or bulk use of the free tools.

Accounts that break these rules are closed without refund, and their activity may be reported to the affected parties.

4. Results

Findings are observations at the time of the scan, each with its evidence. Matches against vulnerability databases are indicative and must be confirmed against the deployed software. A report is not a certification and no scan finds every weakness.

5. Credits

A credit runs one scan or unlocks one full report. A scan that fails to complete is refunded automatically. Credits are not exchangeable for money.

Credits are digital content. When you ask for them to be added to your account straight away, you agree that the right of withdrawal ends once they appear there.

6. Liability

The service is provided as is. To the extent permitted by law, the operator is not liable for damages arising from the use of the service or of its results.

7. Complaints and disputes

Send complaints to the operator.