Never check my domain again.
Last updated 2026-10-04. If you operate a domain and do not want the free checker at /check to contact it, ask and it will be refused. You do not need to give a reason, and you do not have to wait for an investigation. This page is also where misuse of the service is reported.
Before Anything Else
This page is a draft for a qualified lawyer to review before the free checker is switched on for the public, alongside the terms of use, the acceptable-use policy and the privacy notice. The technical behaviour described below is what the code does; the policy wording around it has not been reviewed.
If you arrived here from a TLS connection in your logs and want to know what it was, the scanner identity page answers that: the port, the number of connections, the handshake, and the fact that no HTTP request is ever sent to your host.
Asking Never To Be Checked
Write to the address above and say which domain to add. Include:
- The domain. One or more hostnames or registrable names. An entry covers that name and everything under it:
example.comalso coverswww.example.comand every other subdomain. - Something that shows you speak for it. An email from an address at that domain is usually enough. If you cannot send from it, say so and the operator will ask for something else that fits — for example a DNS TXT record you add, or a file served from the domain. There is no automated verification procedure, because an opt-out is added by hand.
- Nothing else is needed. No reason, no justification, no account.
Response time: placeholder. No acknowledgement or completion time has been committed to for this service yet. The operator must state one here before the checker is switched on publicly. Until then, do not read anything on this page as a service-level commitment.
What The Opt-Out Does
These are statements about the code, not intentions.
The opt-out is the first thing tested after the hostname is validated — before the name is resolved, before the cache is read, and before any budget is spent. An opted-out domain is not resolved, let alone connected to. The request is refused with a message saying the domain asked not to be checked and that nothing was contacted.
An entry for example.com refuses example.com and every subdomain of it, however deep.
Adding the opt-out deletes the cached result for that domain and for its subdomains in the same operation, and hides the permanent record at /r/{domain} along with its history. The record page, every past observation, the JSON and the CBOM all answer with the refusal instead, and the domain drops out of anything that lists records. Hidden rather than erased: see what the opt-out does not do, below.
The badge at /r/{domain}/badge.svg keeps answering, with the same neutral grey image a domain nobody has ever checked gets. Two reasons, both practical: a refusal would break any README the badge was already embedded in, and an image that refused only for opted-out domains would itself announce that you opted out.
The opt-out list is held in the service's own table and in a configured list. If the table cannot be read, the configured list still applies and the failure is logged loudly: a storage error must never silently un-opt-out a domain.
An honoured opt-out is not removed unless the domain owner asks for it to be removed.
What The Opt-Out Does Not Do
- It does not erase the check log. The log rows for your domain — the domain, the time, the outcome and a salted hash of each requester's address — stay until the retention window prunes them, because they are what makes an abuse report investigable. The window is 30 days by default on this deployment.
- It does not erase the record, it hides it. The observations — what this service measured about your endpoint, and when — stay in the operator's database and become unreachable through every public route. They are kept for the same reason as the check log: they are the evidence of what was checked and what was seen, which is what makes a complaint about this service answerable. If you want them erased rather than hidden, say so in your request; that is a decision for the operator rather than an automatic outcome, and the answer should tell you which one you got.
- It does not reach copies of a result someone already downloaded, shared or cached in their own browser — including a search engine's cached copy of a record page, which is out of this service's hands once it has been crawled.
- It does not change Certificate Transparency. Your certificates are published in public, append-only logs run by other organisations. This service reads them; it cannot add to them or remove anything from them. If you want to know what is published about your domain there, the logs are searchable directly.
- It does not affect the paid platform, which only ever scans targets a customer has approved in their own workspace.
Reporting Misuse
If you believe the service has been pointed at something it should not have been, or used as part of something worse, write to the same address. Useful information, roughly in order of usefulness:
- The hostname that was contacted, exactly as it appears in your records.
- A time window in UTC, with the timezone stated. The check log is per domain and per timestamp, so a window turns a report into a list of rows.
- What you saw: the relevant log lines, connection records or alert, and the address the connection came from.
- What you want done: an opt-out, an explanation, or both.
- How to reach you.
What the operator can tell you: for your domain, the times a check was attempted, the outcome of each — including refusals — and a salted hash per requester, where two rows with the same hash came from the same address. What the operator cannot tell you: the requester's IP address. It is never stored, only a salted hash of it, and the hash cannot be reversed. That is deliberate, and if a request requires more than that, the honest answer is that the data does not exist.
If the complaint is about a particular domain, the operator's first step is to add the opt-out, before investigating anything.
If You Would Rather Block Us
You can, and nothing here objects to it. Two things worth knowing: the scanner identity page is where the egress addresses will be published for exactly this purpose, and a blocked connection produces a result that is reported as failed, with no verdict and no score. A failed check never reads as a clean one.
An opt-out is the better route if what you want is for the contact not to happen at all, because it stops before DNS rather than at your firewall.
Related
Terms of use, acceptable-use policy, privacy notice for the checker, scanner identity, and the live guardrails on /check. For anything to do with the paid platform rather than the free check, use support.