Acceptable Use Policy

Our tools read publicly available web pages the way any visitor's browser would. They are diagnostic instruments, not attack tools, and they must not be used to do anything to a website that its owner would not permit an ordinary visitor to do.

You may submit an address if any of the following is true:

• You own or operate the site.
• You have the owner's permission to test it.
• It is a publicly published page that anyone can visit, and you are simply reading it.

• Using the tools to generate load against a site — repeated or automated submission intended to consume another party's bandwidth, capacity or budget.
• Attempting to reach private, internal or restricted infrastructure, including addresses on a private network, cloud metadata endpoints, or anything behind someone else's firewall.
• Using the tools to probe for vulnerabilities, enumerate hidden paths, test credentials, or evade a site's access controls.
• Submitting addresses that contain credentials, session tokens or other secrets. Results are shared with anyone submitting the same address, so anything in the URL becomes visible to them.
• Circumventing our rate limits — through proxies, address rotation, or scripted access to the site.
• Reselling the service, or running it as the backend of your own product. We do not offer a public API in this phase.

These are not only rules, they are limits in the code. Requests that break them fail rather than being logged and allowed:

• Only HTTP and HTTPS, on the standard ports. Addresses resolving to loopback, private, link-local or reserved ranges are refused in both IPv4 and IPv6, and every redirect is re-checked against the same rules.
• At most 5 redirects, a 15-second total timeout, and a 5 MB ceiling on what we will read.
• One fetch per address per 15 minutes across all users, plus per-user and platform-wide daily limits. A popular address is fetched once, not once per visitor.
• We only ever issue read requests. We never submit forms, never attempt to sign in, and never send credentials.

You can block us. Our crawler identifies itself, and the crawler information page explains exactly how to refuse it in robots.txt or at your server. If our traffic is causing you a problem, tell us and we will look into it — we would much rather hear from you than be blocked silently.

We may block access without notice where we believe this policy is being breached, and we will cooperate with a lawful request from an affected site owner. This policy forms part of our terms of service.