ScanYourSiteBot
An automated website check. If you found this in your logs, this page says what it requested and how to switch it off.
Switch it off
Takes effect immediately and needs nothing from you but the name. We do not ask you to prove anything: you did not ask us to come. Subdomains are covered for new checks; monitoring that someone already set up for a subdomain keeps running — if that is a problem, write to abuse@scanyoursite.app and a person will review it.
How to recognise it
Every request we make carries this User-Agent:
ScanYourSiteBot/0.1 (+https://scanyoursite.app/bot)
What it requested
Basic check — the same requests a browser makes when someone opens the page: the page and its assets, robots.txt, the sitemap, the TLS certificate, the DNS records. Anyone can start one for any domain, and this is the likely reason you are reading this.
Advanced check — around ten requests to specific paths such as /.env and /.git/config, at most three at a time. It runs only after the domain owner has proved control through a DNS record, an uploaded file or a meta tag, and only for thirty days after that proof.
What it never does
- Sends anything other than GET requests — it never submits a form or changes data
- Attempts to log in, guess passwords, or use credentials
- Follows links onto domains other than the one being checked
- Comes back to a domain that has been switched off on this page
Why you saw it
- Someone ran a free external check of the site — this needs no relationship with you
- The owner of the domain connected it to monitoring, which repeats the check on a schedule
A person reads this address
For abuse reports and anything this page does not answer: abuse@scanyoursite.app. We reply within one business day, and hosting abuse desks go first — their clock runs faster.
This is your domain and you want the checks back?
Switching off takes your word for it. Switching back on does not — put the verification record in place and confirm ownership.
Confirm ownership