Terms & Conditions of Service
Clear, transparent legal guidelines establishing acceptable scanning practices, developer REST API quotas, liability disclaimers, and open-source snippet licenses.
1. Acceptance of Terms
By accessing, browsing, or utilizing the SiteScanAPI platform—including the web user interface at sitescanapi.com and our REST API (GET /api/scan)—you agree to be legally bound by these Terms and Conditions.
If you are accessing SiteScanAPI on behalf of a company, organization, or legal entity, you represent and warrant that you possess the requisite authority to bind that entity to these Terms. If you do not agree to all provisions contained herein, you must immediately cease accessing or using the service.
2. Passive Defensive Service Description
SiteScanAPI operates strictly as a passive defensive security scanner. When a scan is initiated, our globally distributed edge nodes execute standard, non-intrusive HTTP GET and HEAD requests and public DNS-over-HTTPS (DoH) lookups against the target Fully Qualified Domain Name (FQDN).
Our engine audits defensive headers (such as HSTS, Content-Security-Policy, Permissions-Policy, X-Frame-Options), checks public DNS records (SPF, DMARC, CAA), and validates security disclosure files (/.well-known/security.txt).
3. Acceptable Use Policy (AUP)
You agree to use SiteScanAPI in compliance with all applicable local, national, and international laws and cybersecurity regulations.
Strictly Prohibited Conduct:
- Denial-of-Service (DoS) Amplification: You may not use SiteScanAPI to flood target web servers or cause resource exhaustion on third-party origins.
- Circumvention of Quotas: You may not employ distributed proxy rotators, botnets, or automated headless swarms to bypass our edge rate-limiting protections.
- Wholesale Commercial Scraping: Automated harvesting of our cached scan database for reselling, commercial bulk marketing, or unsolicited sales outreach is prohibited.
- Misrepresentation: You may not claim that an audit score issued by SiteScanAPI constitutes a legally binding certification of unhackability or an official government security clearance.
4. API Rate Limits & Fair-Use Quotas
To safeguard global edge availability and protect origin hosts, the public anonymous REST API tier enforces a fair-use threshold of:
Requests exceeding this limit will receive an HTTP 429 Too Many Requests status code. Organizations requiring elevated throughput or dedicated edge routing should contact enterprise@sitescanapi.com.
5. Intellectual Property & Open Remediation License
The SiteScanAPI name, trademarks, logos, scoring algorithms, and web interface design system are the exclusive intellectual property of SiteScanAPI.
Open-Source Grant: All remediation configuration code snippets generated by our engine (including Nginx server blocks, Apache directives, Caddyfile entries, and Cloudflare Worker code) are released under the MIT / CC0 Public Domain License. You are granted an unconditional, perpetual, worldwide right to copy, modify, distribute, and embed these snippets in your commercial and personal software without attribution.
6. Disclaimers of Warranties ("As-Is")
Mandatory Legal Notice:
SITESCANAPI IS PROVIDED ON AN "AS IS" AND "AS AVAILABLE" BASIS, WITHOUT WARRANTIES OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, OR UNINTERRUPTED ACCURACY.
SECURITY AUDITING HEURISTICS ARE INFORMATIVE IN NATURE. PASSING AN AUDIT OR ACHIEVING A GRADE OF 100/100 (A+) INDICATES CONFORMANCE WITH COMMON DEFENSIVE SPECIFICATIONS BUT DOES NOT GUARANTEE THAT A WEB APPLICATION IS FREE FROM APPLICATION-LAYER VULNERABILITIES, ZERO-DAY THREATS, OR SYSTEM EXPLOITS.
7. Limitation of Liability
TO THE FULLEST EXTENT PERMISSIBLE UNDER APPLICABLE LAW, SITESCANAPI AND ITS OPERATORS, DIRECTORS, EMPLOYEES, AND CLOUD INFRASTRUCTURE PROVIDERS SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, CONSEQUENTIAL, SPECIAL, OR PUNITIVE DAMAGES, INCLUDING BUT NOT LIMITED TO LOSS OF PROFITS, DATA, USE, GOODWILL, OR BUSINESS REPUTATION, ARISING FROM OR RELATED TO YOUR USE OF OR INABILITY TO USE THE SERVICE.
8. Service Availability & Edge SLA
While we target 99.9% edge availability across our global Cloudflare Workers deployment, we do not guarantee uninterrupted or error-free execution on our free public tiers. Scheduled maintenance windows, upstream DNS propagation lags, or origin server timeouts may occasionally affect scan outcomes.
9. Domain Exclusion & Opt-Out
Verified domain owners who prefer not to have their public security headers displayed on our search interface may submit a Domain Exclusion Request. Verification is confirmed through a temporary DNS TXT record or an authorized email from the target domain's registered security contact. Submit requests to privacy@sitescanapi.com.
10. Governing Law & Modifications
We reserve the right to revise or update these Terms & Conditions periodically. Continued use of SiteScanAPI following posted revisions constitutes acceptance of modified terms.