Acceptable Use Policy

Effective 25 October 2026

Scanylo is a tool for checking your own websites. This policy says who may use it, how, and what we do not allow. It is part of our Terms of Service.

1. Only check sites you own or are authorised to check

You may check a website only if:

  • you own it, or
  • you are the person or company responsible for running it, or
  • the owner has given you clear permission to run external security checks, for example in a maintenance, hosting or support contract.

Ticking the confirmation box before a check is a statement that one of these is true. We keep a record of it. If you are not sure, ask the site owner first. Curiosity about someone else's site is not permission.

2. Agencies, studios and hosting companies

If you check client sites, you must hold a contract or written permission for each one that allows external checks. You are responsible for that claim. We do not ask for proof for each site, but we may ask you to show it if a site owner complains, and we may end your access if you cannot.

3. What is not allowed

You must not:

  • check a site you are not authorised to check,
  • use Scanylo or its results to attack, harass, extort or damage anyone, or to plan any of that,
  • check a site in order to collect weaknesses to sell or publish without the owner's consent,
  • get around our limits, the Turnstile check, the blocklist or the do-not-scan list, for example with many IP addresses or by scripting the form,
  • load our service in a way that harms it, or copy our reports or text to build a rival service,
  • use false identities or someone else's email address.

If you find a serious problem on a site that is not yours, do not use it. Tell the owner, or follow the site's security.txt or its responsible disclosure policy.

4. How Scanylo works, so you know what you are asking it to do

Scanylo is passive. We read only what a site serves to any visitor. A check:

  • uses a short, fixed list of well-known file addresses, fewer than 30, with one GET or HEAD request each,
  • makes at most about 150 requests in total, with at most 4 at once,
  • never sends data meant to trigger a weakness, never changes anything, never guesses addresses from word lists and never logs in,
  • respects robots.txt, except for security checks of well-known files,
  • identifies itself as Scanylo/1.0 (+https://scanylo.com/scanner).

Scanylo has no active testing. You cannot ask it to try anything more.

5. Sites we do not check

We refuse to check:

  • government and military domains (.gov, .mil, .gov.* and equivalents),
  • banks and payment providers,
  • any domain on our do-not-scan list, which includes every domain whose owner asked us to stop,
  • anything else we decide to exclude to protect people or our service.

If you own a site and want it on the list, use the opt-out form or write to [email protected]. We enforce the list in our software before any request is sent.

6. Limits

By default, each domain can have one free check per hour, and each IP address can run three free checks per day. We may change these limits.

7. Reporting and enforcement

If you think someone is misusing Scanylo, or Scanylo checked your site without permission, write to [email protected] with the time, the address and what you saw. We investigate, and we may block users, remove access or tell the site owner what we know. We may also pass information to the authorities where the law requires.

If you break this policy we may stop your access without notice.