The free check on the scanner page is a limited look at a public domain. It is not a full scan.
What it sends
- DNS look-ups through our own resolver (up to 60 queries; they ask DNS, not your web server).
- A few TLS handshakes to port 443.
- Up to four HTTP requests: a GET of the
https://andhttp://landing page, one GET that carries the probe headerOrigin: https://tasscan-cors-probe.invalid, and one GET of a random path that does not exist. - A technology fingerprint read from what was already fetched.
Limits
1 request per second, 20 requests, 60 seconds and one connection at a time. Each visitor can run 3 checks per hour, and each domain can be checked once every 10 minutes.
What it never does
It never crawls, submits forms, scans ports or runs the Standard, Deep or Custom checks. Those need a verified asset and an authorization record.
The result
You see a score, severity counts, the most severe findings (with a line such as "Showing the 5 most severe of 12 findings"), the technologies detected and a TLS summary with the exact certificate expiry. The result shows its own expiry and is kept for a short time only. The visitor's IP address is stored only as a keyed hash for rate limiting; nothing links a check to an account. The checked domain name is stored with the result.
Opt your domain out
If you do not want your domain to be checked anonymously, publish a DNS TXT record:
- Name:
_tasscan.yourdomain.com - Value:
tasscan-optout=1