To build our weekly barometer and our free checks, a robot called TopSecuredScanner visits websites from the outside. This page explains exactly what it does, how to recognise it, and how to tell us to leave you alone.
On a site whose owner has not asked for a check, the scanner reads only what any visitor already sees: it loads the home page and reads the headers, the certificate (TLS), the public DNS records (including SPF, DKIM and DMARC), robots.txt and security.txt. For a legal-notice page it follows the links on the home page or the sitemap. Nothing more.
It identifies itself in its User-Agent as TopSecuredScanner, with a link to this page, and it comes from a small set of addresses whose reverse DNS is scanner-N.top-secured.com.
.env or .git), does not guess hidden pages, and does not connect to administration ports. Those deeper checks run only for an owner who has proven the domain is theirs and asked for them.Most site owners have no simple way to know whether their site is well maintained or wide open. Attackers scan the whole Internet constantly. We measure the same public signals first, to publish a weekly barometer as aggregated statistics that never name a vulnerable site, and to let each owner find out where they stand. Detailed results are given only to the owner, after they prove control of the domain. We never use any of this to attack a site.
You can simply tell us, with the form below: it applies to every future scan. You can also block the robot yourself, which we fully respect:
robots.txt: a rule User-agent: TopSecuredScanner followed by Disallow: /;.top-secured.com at your firewall.A network operator (a host, for example) can ask us to exclude a whole IP range at once, using the same form.
Enter a domain, an IP address or a network (CIDR). We send a 6-digit code to your e-mail; your request is recorded only after you confirm it with that code. The exclusion is applied within 72 hours and covers every future scan.