Authorized Scanning Policy

1. Purpose of the Service

SiteSecura provides automated defensive website security, encryption validation, and configuration hygiene assessments. The Service is intended exclusively to help authorized website owners, engineering teams, and organizations identify security configuration defects and maintain defensive standards across their public web perimeter.

2. Authorized Targets

You may submit, scan, or monitor only the following targets:

• Your own personal website, domain, or digital property;
• Websites and web applications owned by your employer or organization where you have explicit operational authorization to evaluate security posture;
• Client websites and digital properties where you have received explicit, written authorization from the domain owner or client representative (e.g., agency client agreements); or
• Websites or domains where the owner has expressly invited and documented authorization for public defensive assessments.

3. Unauthorized Targets

You must strictly NOT submit or scan:

• Websites, servers, or domains belonging to unrelated third parties, competitors, or private individuals without authorization;
• Government, educational, or critical infrastructure systems without formal written authorization;
• Private, internal, or non-routable corporate networks;
• Localhost addresses (including 127.0.0.1, ::1, or localhost);
• Internal IP addresses (including RFC 1918 subnets such as 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16);
• Cloud instance metadata services (such as 169.254.169.254); or
• Any target or domain for which you do not hold valid legal authorization.

4. User Responsibility

Before submitting any domain or target to SiteSecura, you must independently determine whether you possess the necessary authorization under applicable laws, organizational policies, and hosting agreements.

SiteSecura operates an automated evaluation pipeline and does not verify ownership or authorization credentials for every public scan target. By submitting a domain to the Service, you represent and warrant that you hold legitimate authority to request the assessment.

5. Defensive Assessment Scope

SiteSecura is engineered strictly as a non-destructive, passive scanner. Our automated checks are restricted to:

• Standard HTTP/HTTPS requests to public ports (80 and 443);
• Inspection of TLS handshakes, certificate expiration, and supported cipher suites;
• Verification of public DNS records (including A, AAAA, MX, TXT, SPF, DMARC, and DNSSEC);
• Inspection of HTTP response headers (such as HSTS, Content-Security-Policy, X-Frame-Options);
• Evaluation of cookie security flags (Secure, HttpOnly, SameSite); and
• Detection of observable server software indicators and configuration disclosures.

Our probes do not inject intrusive application payloads, flood targets, or attempt to modify server state.

6. Activities Not Authorized

Using SiteSecura does not authorize you or any third party to conduct aggressive or unlawful cyber operations, including:

• Vulnerability exploitation or exploit payload delivery;
• Authentication bypass attempts or credential stuffing;
• Brute-force password or directory attacks;
• Denial-of-service (DoS or DDoS) testing or volume stress tests;
• Destructive or invasive penetration testing;
• Uploading unauthorized files, shells, or malicious scripts;
• Malware or spyware deployment;
• Unauthorized reconnaissance or vulnerability scanning against third-party assets; or
• Internet-wide scanning or bulk target harvesting.

7. Abuse Prevention & Enforcement

We employ automated SSRF safeguards, rate limiting, and anomalous scanning detection to protect the Internet and our infrastructure from misuse.

If we determine or reasonably suspect that an account is being used to conduct unauthorized scanning, circumvent scan boundaries, or violate this policy, we may immediately restrict, suspend, or permanently terminate that account without prior notice.

8. Inquiries & Security Contact

If you have questions regarding this Authorized Scanning Policy or need to report suspected scanning abuse: