Responsible use

Only audit sites you're authorized to test

You may run an audit against a website if you own it, or if its owner has given you permission to test it. Before every audit you confirm this. Even though audits are read-only, testing systems without permission may break the law where you or the site are based, and it's always a breach of these terms.

What an audit sends

• Plain GET requests for pages on the site, following its own links, up to the page limit chosen (50 at most).
• Up to 15 requests for the site's own JavaScript files.
• One GET request for each of about 20 well-known paths, such as /.env, /.git/HEAD, /robots.txt and /.well-known/security.txt.
• One request to a random non-existent page, one OPTIONS request, and one request with a test Origin header.

Requests go out three at a time with a pause between batches and identify themselves as IsMySiteSecure/0.1 (+https://ismysitesecure.site; passive security scan). No forms are submitted, no logins attempted, and no exploit or injection payloads are sent.

What the scanner won't do

The scanner won't connect to private or internal network addresses, won't follow links that look like they change data, and won't download more than a capped amount from any single response.

If you saw our scanner in your logs

Every scan requires confirmation that the visitor owns the site or has permission to test it. If you believe an audit was run without authorization, report the time, affected domain and scanner address to the operator. Do not include passwords, API keys or other secrets.