Beacon Scan terms
1. Who may ask for a check
By asking for a check you confirm that you own the website or have the owner's permission to check it. Do not use Beacon Scan on a site you have no right to examine.
2. What the free (passive) check does
It reads only what any web browser receives on a normal visit to the site: the HTTPS certificate, the response headers and cookies of the home page, the home page itself and the scripts it loads, public DNS records (SPF, DKIM, DMARC, MX, CAA), and the public files robots.txt, sitemap.xml, llms.txt and /.well-known/security.txt. It sends one request at a time, about 15 in all. It does not guess paths, log in, submit forms, send attack payloads or scan ports.
3. When the deep check may run
- Only on a domain whose control you have proved: a DNS TXT record
beacon-verify=<your token>, or your token in a file at/.well-known/beacon-verify.txt. - Only after you tick the box agreeing to these deep-scan terms for that domain. You confirm you are authorised to allow this testing on that domain and its subdomains.
- Before every deep check we look for the proof again. If it is gone, the check does not run.
The deep check asks for a short, fixed list of well-known file names (for example /.git/HEAD, /.env, common backup names), a few folder names to see whether they list their files, a few admin page names to see whether they answer, and the subdomains listed in public certificate logs to see whether any points to an unclaimed hosting account. It reads at most a few kilobytes of each answer and does not download whole files. It never tries a password, fills a form or sends an attack payload. It sends one request at a time.
4. Who sees a report
- A free report opens only with the private link created for the person who asked for it.
- An owner or deep report opens only for the signed-in account that verified the domain.
- We never publish a report, list scanned sites, or name a site in anything we write. Our own articles use only totals across many sites (for example, "4 in 10 sites we checked had no DMARC record").
5. What we keep
The domain, the date, the findings and the score. For a free check we also keep a one-way hash of the network address it came from, for the daily limit, and a hash of the private link's secret. We do not keep whole secrets: if a key appears in public code, the report shows only its first and last few characters. Free reports with no owner are deleted after 30 days. Owner reports are kept while the domain stays on your account.
6. Limits
Free checks: 3 a day from one network, and a site can be checked only a few times a day in total. Owner deep checks: one a day per site, plus the weekly re-scan. We may refuse or stop any check.
7. No guarantee
Beacon Scan finds common, visible mistakes. It is not a penetration test or a security audit and cannot show that a site is safe. Act on its findings at your own judgement.
8. If you find a problem on someone else's site
Tell the owner privately (their security.txt, if they have one, says how). In India you can also report a vulnerability to CERT-In under its responsible disclosure policy.