About the scanner

SecureMonk is a free tool that scores a website's TLS configuration and HTTP security headers. Anyone can enter a site's address and run a scan. Each scan is started by someone using securemonk.io; we do not crawl the web looking for sites to scan.

What a scan requests

A default scan asks for the home page of the site you named (the root of that address: any path you typed is not requested), following its redirects (once more if the first attempt fails to connect), the way a browser does. To check the site's TLS setup it also opens a series of TLS connections, trying in turn the protocol versions and ciphers we test, and in one of them sends a single deliberately malformed heartbeat message: the standard test for the Heartbleed bug (CVE-2014-0160). A server that is not vulnerable ignores or rejects it. A vulnerable one answers with a block of its memory; the scanner reads that one reply only to see that it arrived, then discards it without logging or storing any of it. With DNS and email checks turned on, the scan also looks up public DNS records through public resolvers; those queries never reach the site.

The vulnerability scan is the active part, and it is off by default. When you turn it on, it also fetches one of the page's JavaScript files and that file's source map, and requests about 35 well-known paths on the site, such as /.env, /.git/config, admin pages and dependency manifests, to find files that should not be public. These are ordinary GET requests, and they go only to the site you named or its www. address, never to a different site it redirects to. It does not exploit anything, log in, guess passwords, submit forms or send attack payloads.

Run the vulnerability scan only against a site you own or are authorized to test; the scanner asks you to confirm that before it runs. Each site gets a limited number of vulnerability scans per day, counted across everyone, and a site's owner can ask us to stop running them against their domain.

How to recognize our requests

• The vulnerability scan's JavaScript file, source map, path and manifest requests send the User-Agent Mozilla/5.0 (compatible; SecureMonkScanner/1.0; +https://securemonk.io/about).
• The request for the page itself, in both the default scan and the vulnerability scan, uses a standard browser User-Agent, so the page is measured as visitors see it. TLS connections and the Heartbleed test carry no User-Agent.
• Requests come from Google Cloud in the us-central1 region. The addresses are not fixed, so we cannot give you a list to block.

Opting out

To opt your domain out of the vulnerability scan, or to report a scan you did not expect, email [email protected] naming the domain. To opt out we ask you to show you control it, by adding a DNS TXT record or a file under /.well-known/ that we name, which we check by hand; an email address alone is not enough, because sender addresses are easy to forge. The opt-out covers the domain, its www. address and every subdomain, by name. The vulnerability scan never runs against a bare IP address, but it does not know when another domain name points at the same server.

For an opted-out domain the vulnerability scan makes no requests at all. The default checks described above still run.

Contact

Abuse reports, opt-out requests and security reports about SecureMonk itself: [email protected]. This is the same address as our security.txt.

More detail: Terms, Disclaimer, Privacy.