What this may be used for.
Last updated 2026-10-04. This is the line between a readiness tool and a reconnaissance tool. The free check at /check makes a connection to a host the person asking may not own, so what it may be used for has to be stated, and it forms part of the terms of use.
The Short Version
This tool reads public Certificate Transparency data for a domain and makes at most two TLS connections to it on port 443. That is the same kind of contact a browser or SSL Labs makes, and nothing more. Check hosts you own, or hosts whose public configuration you have a legitimate reason to read. Do not use it as a step in attacking anyone, and do not automate it.
The statement the service itself publishes is served by GET /api/public-check/config and shown on /check, so it cannot drift from the running code. This page is the longer form of that statement. If the two ever disagree, the one the service publishes describes the software that is actually running, and the difference is a bug — please report it to the address at the bottom of this page.
Permitted
Any hostname you operate, or operate on behalf of someone who asked you to. This is what the tool is for.
A vendor, processor or partner whose public TLS posture is part of your own due diligence. You are reading what their server tells every browser that visits it.
Research, teaching, journalism, or a public-interest look at a public endpoint. One domain, because you have a reason to look at that domain.
In all three cases the limits still apply, the result is still public at its URL, and the domain owner can still opt out.
Prohibited
- Automated or bulk use. Do not drive this from a script, a crawler, a job, or a list of domains. One hostname at a time, because you have a reason to look at that hostname. The cached result is the same answer as a fresh one, so re-running it gains nothing.
- Enumeration. Do not work through subdomains, name lists or an organisation's estate. The service does not discover subdomains, and using it as a substitute for a tool that does is prohibited.
- Mapping someone else's attack surface. Do not use this service as a reconnaissance step against a third party, whether or not what follows is an intrusion. This is the use this policy exists to refuse.
- Trying to make the service connect somewhere it refuses. IP literals, private, loopback, link-local, carrier-grade NAT and reserved addresses, names engineered to resolve inside a network, DNS rebinding, credentials before the host, ports other than 443, and wildcards are all refused in code. Attempting it anyway is a breach of this policy, and the attempt is logged.
- Circumventing the rate limits. Do not rotate addresses or use proxies, many clients or repeated refreshes to get around the per-address, per-domain or service-wide budgets. The per-domain budget exists so one host cannot be hammered even from many addresses.
- Reselling the output as a service, or presenting a result as your own audit, certification or attestation. The result is a point-in-time observation of one endpoint and says so; passing it off as more than that misleads whoever reads it next.
- Anything unlawful where you are, or where the host you name is.
What Happens On Breach
Most of the enforcement is automatic and impersonal: a request outside the rules is refused with a reason, and an address or a domain that is over budget is rate-limited with a retry hint. Beyond that:
A requester who behaves as described above is blocked. This happens upstream of the application, at the edge, because the check log stores only a salted hash of a requesting address — the checker itself holds no requester blocklist and could not enforce one from a hash. The limits can also be tightened for everyone, and the service can be switched off entirely.
If a domain owner asks, their domain is added to the opt-out list and is refused before its name is resolved. That is done first, before any investigation.
Where the law requires it, or where a competent authority makes a valid request, the operator will refer a matter or respond to that request. The check log holds the domain, the time, the outcome and a salted hash of the requesting address — not the address itself. If more is asked for than that, the honest answer is that the data does not exist.
If You Operate A Domain You Do Not Want Checked
You do not have to argue the point or wait for an investigation. Ask, and the domain is refused before anything is resolved or connected to, including everything under it, and its cached result is deleted. The route and what to include is on the abuse and opt-out page. The scanner identity page describes exactly what the traffic in your logs was.
Your Own Copy Is Not Covered By This
The checker ships with the platform source under the MIT licence and runs from the command line against your own copy. This policy governs use of this hosted service. If you run your own copy, you are the party making the connections and the rules that apply are those of your own jurisdiction and your hosting provider.
Contact
Abuse reports, opt-out requests, and anything you think this page gets wrong: no abuse address is configured on this deployment, so the only route is the contact page.