Effective date: 16 October 2026 · Version: 1.1
These terms explain what a ScanDefend scan does and what permission you need before ordering one. They form part of the Terms of Service. ScanDefend is a trading name of IronSky Limited.
1. The short version
- Quick Scan is a passive, read-only, external check of information that a website and public sources already make available. You can order it for a public website only if you have a legitimate reason and follow the Acceptable Use Policy.
- You are solely responsible for having whatever permission the law, the site owner or any contract requires before you order a scan.
- ScanDefend does not perform penetration testing. A scan reports what it can observe from outside, at the time it runs. A report describes the checks that ran and lists the ones that didn't.
- We may refuse or stop any scan (section 6).
2. What a Quick Scan does
A Quick Scan is a passive, read-only, external check of publicly available information about a website and its domain, for example HTTPS, security headers, email security records, announced software versions and known vulnerabilities, cookies and DNS health.
It uses a small number of polite requests, from a scanner that identifies itself as ScanDefendBot/1.0 (+https://scandefend.com/bot), and consults public sources about the domain. Scanning is strictly limited, including how often the same website can be checked across all customers. We decide which checks run and may change them at any time to keep scans safe and useful.
A Quick Scan never logs in, submits forms, tries passwords, exploits a weakness, uses or tests anything it finds, or tries to break in. Scans of opted-out websites, of private network addresses and of anything that isn't a public website are refused.
Even a read-only check is an interaction with the website, and the site may record it in its logs. Website owners can see what ScanDefendBot is and how to opt out on our bot page.
3. Who may order a Quick Scan
Because a Quick Scan only reads what is already public, you don't have to prove ownership. But by ordering one you confirm and promise that:
- you have a legitimate reason to check the website, for example it is your site, a client's site with their agreement, a site you are responsible for, or a site you are deciding whether to trust;
- ordering the scan does not break any law, contract or instruction from the site owner that applies to you;
- you will not use the results to attack, break into, disrupt, threaten, embarrass or extort anyone (see the Acceptable Use Policy); and
- you accept that we may refuse or stop the scan (section 6).
4. More active testing
Only the Quick Scan described in this document is offered. If we add a service that actively tests or scans websites, it will run only after you sign in and prove that you control the domain, confirm that you own the website or have the owner's written authority to test it, and accept the scope and terms we publish at that time.
5. Your promises and responsibility
When you order any scan, you promise that the information you give us is true and that you are entitled to order the scan under these terms.
If you order a scan you weren't entitled to order, you are responsible for the consequences, including the claims, losses and costs described in section 17 of the Terms of Service. We may give the site owner, our providers or the authorities relevant details about the order (including your identity and contact details) where the law allows or requires it, or where we need to in order to protect our rights or others.
6. We may refuse or stop scans
We may refuse, delay or stop any scan at any time, without notice, if we think it is unauthorised, abusive, unsafe, against an opt-out, over a limit, or creates legal or other risk for us, or if a site owner complains. When a site owner reports a concern, we block new scans of that site while we look into it. If we cancel a scan before it runs, or it fails on our side, its credit is returned as described in the Refund and Credit Policy.
7. Site owners
If you own a website and don't want ScanDefend to check it, use the opt-out form on our bot page or email abuse@scandefend.com.