About the scanner
The website security scanner reads the configuration a public site sends to every visitor. This page describes its requests and how to block it.
What it checks
The scanner evaluates the secure connection, headers, cookies and content of a domain's home page.
It also checks the DNS records that protect the domain's email: SPF, DMARC and CAA.
It is not an audit or a penetration test: it only reads what the site sends to every visitor.
How it identifies itself
Every request from the scanner carries this User-Agent:
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 AlexHerreraScanner/1.0 (+https://www.alexherrera.dev/en/tools/scanner/about)Requests come from Vercel's network, which does not use fixed IP addresses.
Which requests it makes
- DNS queries to 1.1.1.1: the domain's addresses and its TXT, MX and CAA records.
- Up to six TLS connections to port 443: a normal one and two more with TLS 1.0 and TLS 1.1, each retried once.
- One GET request to the home page over HTTPS: 10 seconds and 2 MB at most, and up to 5 redirects within the same site.
- GET requests to the home page over HTTP, up to the first redirect to HTTPS, to check that it exists.
- One GET request to /.well-known/security.txt.
The scanner does not submit forms, does not try passwords and does not visit other pages of the site.
Who starts a scan
Every scan is started by a person who types the domain into the scanner form. Each submission passes the Cloudflare Turnstile bot check.
Each IP address can start 5 scans per hour, and the scanner runs at most 500 scans a day.
How to block it
Block the User-Agent "AlexHerreraScanner" on the server or in the site firewall. The scanner shows the block in the result and does not try to get around it.
What data it keeps
The scanner keeps the report and the scanned domain for 30 days so that you can share its link. Anyone with the link can see the report, which does not include the IP address of the person scanning.
To apply the hourly limit, it stores an HMAC hash of the IP address of the person scanning. The hash changes every hour, cannot be turned back into the IP and is deleted after 48 hours.
Contact
For any question about the scanner, write to alexhmanzanares@gmail.com.