Scanner
Scan a website you control
Add the website you want to assess, prove you control its domain with a DNS TXT record, and run a Quick or Standard scan: TLS and certificate analysis, a bounded crawl, HTTP security headers, built-in passive analysis, a passive OWASP ZAP assessment and, in Standard, a curated Nuclei template set for exposed files, debug endpoints and panels. Results appear live and end in a report you can hand to a client.
How it works
- Add the target. You get a verification value to publish as a DNS TXT record at
_scanbastion.<your domain>. For a client's domain, send them the record; adding it doubles as their acknowledgement that assessments will run. How DNS TXT verification works. - Verify. Once the record is live, check it from the target page. Verification lasts 30 days, and the record is looked up again before every scan; remove it and scanning stops.
- Scan. Pick a profile and start. Follow the stages live, stop at any point, and open the report when it finishes.
Profiles
| Limit | Quick | Standard |
|---|---|---|
| Checks | TLS and certificate, crawl, HTTP security headers, built-in passive analysis, passive OWASP ZAP | Quick plus curated Nuclei templates |
| Maximum duration | 8 minutes | 20 minutes |
| Maximum requests | 150 | 600 |
| Requests per second | 1 | 2 |
| Pages crawled | up to 25 | up to 100 |
Every request identifies itself with a User-Agent containing ScanBastion and a link to the Responsible Scanning Policy. Scans never contact private network addresses, never leave the verified hostname and its www variant, never submit forms, log in or send attack payloads, and stop early if the site starts answering with errors or rate limiting. The scan engines pages describe each check and what it cannot tell you.
Frequently asked
Can I scan a site I do not own?
Only with the owner's explicit permission, and only once the DNS record is in place, which means the person who controls the domain has agreed. The Responsible Scanning Policy sets out the rules.
Will the scan affect the site?
It sends at most 2 requests per second, all of them ordinary GET requests, so a site that serves visitors will not notice it. It does not submit forms or follow links that look like actions (log out, delete). If the site answers with repeated errors or rate limiting, the scan stops.
What happens to the results?
Scan results are stored for 90 days and are reachable only through the scan's link. Evidence is clipped and secrets such as cookie values are masked before anything is stored. See the Privacy Policy.