Questions we get about the check
Published · updated
Everything below is about the same thing: what a stranger can learn about your site from outside, and where that stops being enough. If an answer here is uncomfortable, it is still the answer.
What the check does
It sends ordinary public requests to the address you enter, reads the responses — status, headers, cookies, HTML, DNS records — and reports what is visible. Findings are ordered by consequence, not by acronym: what a bot could use first, in plain words, with the change that closes it.
It takes 5–20 seconds for a typical site and up to 50 for a slow one. A repeat check within ten minutes is served from the cache and returns instantly.
Where the limits are
- A clean report does not mean “safe”. It means nothing visible was open at that moment. Logic bugs, authorisation mistakes, stolen credentials and server-side problems behind a login are all outside a passive check.
- One page, one vantage point. We read the address you gave us from one network. A geo-blocked or huge site may answer differently elsewhere.
- Hidden versions stay hidden. If your server does not publish the PHP build, the report cannot confirm a patch — it says so instead of guessing. How to read the build on the server →
- Rate limits are real. 60 checks a minute per address; a pool of workers is finite and a check occupies one for seconds.
Reading the verdict
Critical means something is open or published that should not be: an exposed configuration file, a reachable database client, a PHP build below the October 2026 fix. Treat it as a task for today.
Notes are gaps that cost trust or traffic rather than opening a door: a missing header, a cookie without HttpOnly, an old TLS version. A week is a reasonable deadline.
Findings we cannot apply to your stack are marked n/a instead of “passed” — a static site does not get a PHP verdict, and pretending otherwise would inflate the score.
False positives and failures
Two things go wrong most often. A server that answers every path with your homepage makes the checker think a file exists — we test the body, not only the status code, but exotic setups still slip through. And a site behind a firewall can refuse our request entirely, which the report shows as “that site did not answer” rather than inventing findings.
If either happens, send the domain to hermes@mikero.ru and we will look at the specific case.
Is it really free?
Yes — the full report, every finding and every fix, with no account and no email. Paid extras are planned around it: monitoring with a monthly check and an alert when a new critical appears, a branded PDF for agencies, white-label for hosting companies. None of them will sit in front of the result you can get today.
Questions
Do you keep my site's address?
The engine stores a hashed domain and the codes of the findings for statistics — not the domain itself, not the page contents. The privacy page describes the exact fields.
Why does the checker need my site to answer a request?
That is the whole method: passive checks read what the server already sends to anyone. A site that refuses all non-browser clients cannot be checked passively — and a firewall that blocks us may block real users too.
Can I check a site I do not own?
The request is passive, but use it on sites you are responsible for or have permission to review. We do not support building lists of other people's weak sites.
How often can I re-check the same site?
As often as you like — a repeat within ten minutes returns the cached result instantly, which also keeps the load on your server at one check instead of ten.