Skip to content
Check a domain

For developers

Deterministic checks.Evidence on everything.

Every finding carries its evidence, a confidence level, the fix and its limits.

The model

Fixed rules.Severity set by rules, every time.

The same observations always give the same findings.

  • Evidence on every finding

    The exact header, record or response behind it, so you can verify it yourself.

  • Confidence apart from severity

    Confirmed: observed. Likely: inferred from strong signals. Informational: useful context.

  • Configuration health

    A versioned formula over the checks that ran, with coverage shown.

  • Read-only by design

    A Quick Scan checks eligible public websites with no ownership-verification step and reads only what's public.

The finding shape

One document per finding.The real contract.

The JSON export: one of these per finding, plus the scan's scope.

example.com

Abridged. Field names are the real contract; values are hand-written.

{
  "id": "F3",
  "ruleId": "dns.dmarc.missing",
  "severity": "low",
  "confidence": "confirmed",
  "asset": "example.com",
  "title": "Add a DMARC record for your domain",
  "impact": "A DMARC record tells receiving mail servers what to do with email that claims to come from your domain…",
  "remediation": "Publish a _dmarc TXT record. Start with v=DMARC1; p=none; …",
  "effort": "minutes",
  "limits": "We checked the public DNS record; your mail provider's own settings are outside a Quick Scan."
}

What a check covers

Light, read-only checks.From the outside.

Each area reports what it found and the scope it covered.

Questions

Things you'll ask.

Something else? support@scandefend.com

Is there an API?

Today you get JSON export from any saved report. Would an API help? Tell us at support@scandefend.com: your requests shape what we build next.

Can I scan localhost or a staging IP?

A Quick Scan checks public hostnames that resolve to public addresses, so localhost and private IPs are out of scope. Staging behind a public hostname works well.

Do you honour robots.txt as an opt-out?

Opting out works through the form on the ScanDefendBot page today, rather than robots.txt. Opted-out domains are kept out of checkout, so no one can order a scan of them.

What does it check about HTTPS?

A Quick Scan confirms your site answers over HTTPS and moves plain HTTP there. Every check also runs a full encryption (TLS) test of your protocols, ciphers and certificate.

Keep exploring

Also useful: What we check Sample report Pricing

See what your website shows.Know what to fix first.

See pricing