Frequently asked questions

Yes. An audit only reads: it requests your pages and a short list of well-known files, a few at a time with pauses in between, up to the page limit you set. It never submits forms, logs in, uploads anything or sends attack strings.

Yes. Requests identify themselves with the user agent IsMySiteSecure/0.1 (+https://ismysitesecure.site; passive security scan), so you can recognise and filter them.

It reads robots.txt but doesn't treat it as a list of places to avoid, because audits are run by the site's owner and the paths listed there are often exactly what needs checking. If robots.txt advertises sensitive paths, that's reported as a finding.

It means the common, visible misconfigurations aren't present. Passive checks can't find injection bugs, broken access control, problems behind a login, or flaws in your business logic. For those you need a code review or penetration test.

Every audit starts at 100. Each open issue subtracts points by severity: 30 for critical, 15 for high, 6 for medium, 2 for low. Any critical issue caps the grade at D and any high issue at C. The full scale is on the how-it-works page.

Yes. That's why each finding shows its raw evidence alongside Claude's verdict, findings Claude dismissed stay visible in their own section, and anything Claude noticed on its own is labelled unverified. Use the review to prioritise, and check before you act.

For packages your pages load in the browser, yes. We identify each JavaScript library and version and look it up in public vulnerability and malware databases at the moment of the audit, and we check for indicators from recent supply-chain incidents. Packages that only run on your server aren't visible from outside. The supply-chain watch shows what we're tracking and when it was last updated.

The report tells you exactly why and how to fix it. The most common reasons are a misspelled domain, a site that's down, password protection, or a firewall or bot-protection service (such as Cloudflare) blocking automated visitors. For firewalls, the report gives step-by-step instructions to let the audit through. The scanner also deliberately refuses to connect to private and internal network addresses.

Only if the owner has given you permission, such as a client who hired you. Every audit asks you to confirm this. See responsible use.

Reports are saved in your own browser, not on our servers, so they're there when you come back on the same device. Use Export on a report to keep a copy or share it, and Delete to remove it. With AI review on, a summary of the crawl and the findings is sent to Anthropic's API for analysis. The privacy page has the details.

No. Reports live only in the browser that ran the audit, so a report link won't open on anyone else's device. To share a report, use Export and send the file.