Legal

Acceptable use

Last updated 14 August 2026

This service sends real attacks at a real website. One rule matters more than the rest.

Scan only what you own or are authorised to test

You may run a scan against a site you own, or one whose owner has authorised you in writing to have it tested. Running it against anything else is unauthorised access, and in the United Kingdom that is a criminal offence under the Computer Misuse Act 1990.

We enforce this technically as well as contractually. You place a file we name at a path we name on the site's own web root, and nothing is sent at the site until that file comes back with the right value in it. We re-check it when the scan starts.

The demo is the exception, and it is ours

The demo scan runs against one fixed, deliberately vulnerable public test site chosen by us. You cannot point it somewhere else: the target is set on our server and is never taken from what you type.

What else is out of bounds

• Using a finding from someone else's report to attack their site.
• Reselling or republishing our reports as your own testing.
• Trying to make the scanner attack a third party, including through a redirect on your own site.
• Attacking this service itself outside the terms on our security page.

If you break this

We stop your scans and close your account. Where a scan looks like unauthorised access to someone else's system, we cooperate with the relevant authorities.