securityscanner.org

Terms of use

One line: only sign up sites you own or are authorised for, for a US business; the scan is free, read-only unless you ask for more, and comes with no guarantee; the list is never sold; unsubscribing stops the scans too; North Carolina law applies.

Last updated 30 October 2026. Plain words on purpose. If any part is unclear, write to abuse@securityscanner.org before signing up.

1. Who is offering this

securityscanner.org (the scanner, the service) is operated by Human Compute LLC, a limited liability company in Winston-Salem, North Carolina, United States (I, me). By signing up a domain you agree to these terms.

2. What the service is

A free, automated check of a website's publicly visible security, run from outside, with the results sent to you by email, once when you sign up and then monthly. Free forever, no paid tier. There are three levels, and what each one does is this:

  • Email-confirmed. Read-only checks of what the site already shows the public, monthly. At most 25 ordinary web requests plus DNS lookups and connection attempts to common ports. Nothing is logged into, submitted or changed. The checks are listed on what gets checked.
  • Owner-verified. Everything above, plus a monthly crawl of the pages your site links to with passive rules run on each page. Still read-only. Only after you prove you control the domain, as described in section 3.
  • Active scan, opt-in only. Coming later. When it comes, it is a separate yes from you for each domain. An active scan sends requests that resemble attacks. It may create, modify or delete data, submit forms and leave entries in your logs. The scanner's own warning to that effect is shown before you can turn it on, and it is never on by default.

At both free levels the scanner never submits forms, never logs in and never attacks. That promise holds for everyone who has not separately opted in to an active scan.

3. Only sites you are allowed to scan

You may only submit a domain that you own, or that you are expressly authorised by its owner to have tested, for example as the owner's employee, developer or agency. You confirm this on every submission, and you will show proof of that authority if I ask for it. Submitting someone else's domain without that authority is a breach of these terms and may be unlawful. If a complaint shows a domain was submitted without authority, scans stop, the sign-up is removed, and the evidence (the email domain that confirmed, or the verification record, with timestamps) is given to the complainant.

Proof is required in every case. For the email-confirmed level: a confirmation link clicked from an email address at the domain. Free webmail addresses (Gmail, Outlook, Yahoo and similar) are not accepted. For the owner-verified level: a DNS TXT record at _securityscanner.<your domain> with the value securityscanner-verify=<your token>, or a file at /.well-known/securityscanner on the site containing that value. The proof is checked again before every run, and the run is skipped if it is gone.

4. US businesses

The service is offered to businesses and organisations in the United States. Sign-ups for domains under a country code outside the United States (for example .uk, .de, .ca or .au) are refused. Everything else is on your own declaration at sign-up. It is not offered to individuals for personal sites, or to businesses outside the United States, and sign-ups that do not fit may be removed.

5. How results are delivered

Results go only to the verified email address for that domain. No results are published. Today, the full report is in the email. I reserve the right to change that later so that the email tells you a report is ready and you open it by clicking through, logging in and passing an anti-bot check such as a captcha. That may happen at any time without notice, and it is there to keep reports about your site private as the list grows. Reports are for the domain owner and their authorised people. Do not forward a report about a domain to anyone not entitled to it.

6. How the scanner identifies itself, and how to stop it

Every request the scanner sends carries this User-Agent, exactly: Mozilla/5.0 (compatible; SecurityScannerBot/1.0; +https://securityscanner.org/about-our-scans; abuse@securityscanner.org). It runs from one fixed, named IP address, published on the page about the scans before the first scan of anyone else's domain. Any of these stops the scanner for a domain:

  • Remove the TXT record or the .well-known file, or set the value to securityscanner-verify=deny. A deny value stops scanning at every level.
  • Click unsubscribe in any email. Unsubscribing stops the scans as well as the email, always.
  • Email abuse@securityscanner.org.

A stop is honoured within two days and normally within the hour. Scans for that domain do not run again unless the domain is signed up and proved afresh.

7. No guarantee

The scanner finds common, publicly visible problems. It cannot find every problem, and a clean report is not a guarantee of security: a good grade does not mean a site cannot be broken into. Grades and wording are my own judgement, not any standard or certification. Results may be wrong, incomplete or out of date. Fixes are your responsibility; check them with your own developer or host before relying on them.

The service is provided as is and as available, with no warranty of any kind, express or implied, including fitness for a particular purpose and uninterrupted operation. It may be paused, changed or shut down at any time.

8. Not SOC 2

Where this site or a report says aligned with SOC 2 controls, it describes the separate paid readiness work I do for clients. No audit has been done on that work. Nothing here is certified or compliant, no such certificate exists, and the AICPA logo appears nowhere. The scan is not part of SOC 2, and a clean scan does not mean SOC 2 readiness.

9. Effect on your site, and liability

Scans are designed to be harmless: ordinary web requests, DNS lookups and connection attempts, at a gentle rate. Even so, you accept that any automated traffic carries a small risk, and you confirm that the site can receive it. To the fullest extent allowed by law, Human Compute LLC and Adam Ridley are not liable for any loss, damage, downtime, data loss, cost or claim arising from the scans, the reports, acting or not acting on a report, or the service being unavailable. Where liability cannot be excluded by law, it is limited to the greatest extent the law allows, and in any case to one hundred US dollars. Nothing in these terms limits liability that cannot be limited under the law that applies to you.

10. If you submit a domain you were not allowed to

If you submit a domain you were not authorised to submit, you are responsible for the consequences. You agree to indemnify Human Compute LLC and Adam Ridley against any claim, loss, cost or demand, including reasonable legal fees, that arises from that submission.

11. Your email address and the list

Your address is used to confirm the sign-up, send the reports, and send occasional short notices about the service itself. Addresses and scan results are never sold, rented, shared or given to anyone, sponsors included. If a sponsor ever appears in the monthly email, the item is marked Sponsored, and the sponsor sees only aggregate counts: how many people are on the list, never an address, a domain, a per-recipient link or a tracking pixel. The privacy notice has the detail. Your address and personal data are deleted 30 days after you unsubscribe. The record that the scan was authorised, and a minimal scan log, are kept for 13 months, as described there.

12. Every email is a commercial message

The emails are commercial messages under US law (CAN-SPAM), and they follow it: the postal address of Human Compute LLC is in every message, a visible unsubscribe link works for at least 30 days after each message is sent, an unsubscribe is honoured within two days, and any sponsored content is marked Sponsored.

13. I may refuse, pause or stop

I may refuse, pause or stop any scan or close any sign-up at my discretion, and I will pause a domain on any complaint about it while the complaint is looked at. Other reasons include the site blocking the scanner, the terms not being met, or the service closing.

14. Acceptable use

Do not use the service to probe sites you are not authorised for, to build a list of other people's weaknesses, to resell the reports as your own product without saying where they came from, or to interfere with the service. Agencies and developers may sign up client domains they are authorised for and use the reports in their work for that client.

15. Changes to these terms

These terms may change. The date at the top moves when they do, and a material change is mentioned in the next monthly email. Continuing to receive reports after a change means you accept it.

16. Law

These terms are governed by the law of the State of North Carolina, United States, and any dispute is heard in the state or federal courts for Forsyth County, North Carolina, unless the law that applies to you says otherwise.

17. Contact

Human Compute LLC, 1331 Murphy Ln, Winston-Salem, NC 27104, United States. abuse@securityscanner.org. Phone +1 336 777 7237.