Free scan

How the security checker works

The free security checker on this website looks at a site from outside, the way a browser does, when someone asks it to. This page explains what that means if you saw it in your logs.

How it identifies itself

Every request it makes carries this User-Agent:

SilentThreadsSiteCheck/1.0 (+https://silenthreads.com/security-checker/about)

What it requests

• The homepage, over HTTP and HTTPS, and the TLS certificate.
• /robots.txt.
• A short list of well-known paths that shouldn’t be public: /readme.html, /license.txt, /.git/HEAD, /.env, common wp-config.php and database backup names, and two folders to see whether they list their files.
• On WordPress sites: /xmlrpc.php, /?author=1, /wp-json/wp/v2/users and /wp-login.php.
• Up to 3 of the homepage’s own JavaScript files.

That is at most 30 GET or HEAD requests per scan, a few at a time, each with a 5-second timeout. Large responses are cut off after the first part. A scan of the same site within 15 minutes reuses the previous result instead of asking again, and each site can only be scanned a few times an hour.

What it never does

• It never logs in, submits a form, sends your site a POST request or tries passwords.
• It never sends attack payloads or tries to exploit anything.
• It never crawls beyond the paths listed above.
• It only connects to public addresses; it refuses private and internal networks.

robots.txt

The homepage check always runs. For the other paths, the scanner follows rules addressed to SilentThreadsSiteCheck, and it skips everything except the homepage when a site’s robots.txt shuts out all bots (User-agent: * with Disallow: /). To keep it away from the deeper checks on your site, add:

User-agent: SilentThreadsSiteCheck
Disallow: /

Skipped checks show as “skipped” in the report, never as a pass.

What is kept

For each scan we keep the domain, the findings, the grade and the time, for 90 days, so the result link keeps working. Page contents and the IP address of the person who started the scan are not stored. If someone asks for the report by email, we also keep their address and the consent they gave; see the privacy policy.

Questions or a problem

If the scanner caused trouble on your site, or you want past results for your domain removed, contact us.