Transparency

What our bot does and how to opt out.

The free Security OS check reads the same thing any browser sees and queries public sources. Here's everything it does, what it doesn't and how to ask it not to check your domain.

Try the check

How to identify it

Every visit to your site carries this User-Agent:

WITS-SecurityOS-Check/1.1 (+https://security.wits.mx/bot/)

What it does

  • Requests your home page once (and checks whether port 80 redirects to HTTPS), like a browser.
  • Reads headers, cookies, the certificate and the TLS versions the server accepts.
  • Reads /.well-known/security.txt, a public file that exists for this (RFC 9116).
  • Queries public DNS (SPF, DMARC, DKIM, CAA, DNSSEC) and certificate transparency (crt.sh).
  • Matches visible versions against public vulnerability databases (OSV.dev, CISA KEV, FIRST EPSS).

What it doesn't do

  • It doesn't scan ports or test exploits, passwords or forms.
  • It doesn't look for private paths (/.env, /.git, admin panels).
  • It doesn't visit the subdomains it finds in certificate transparency.
  • It doesn't store the result; it only travels in your request if you ask us for help.
  • It doesn't check government or military sites, or sites that opted out.

Opt your site out

Email ventas@wits.mx with the subject «Check opt-out» and the domain or IP. We add it to the exclusion list within 2 business days; from then on the tool refuses to check it, including its subdomains.

Terms of use of the check

  1. You may only use the check on domains or IPs you own or manage with the owner's authorization.
  2. Using it to attack, prepare attacks or harass third parties is forbidden. We may block access in case of abuse.
  3. The result is informational, based on what the site shows publicly, and may contain false positives or negatives. It doesn't replace an audit or grant certifications.
  4. The tool is provided «as is», without warranty. WITS isn't liable for decisions made solely on the result.
  5. Data you leave in the form is handled under the WITS privacy notice.
  6. These terms may change; the current version is the one published on this page.

Effective October 24, 2026.

Sources and attributions

Vulnerabilities: OSV.dev (GitHub Advisory Database and other sources, CC-BY 4.0), CISA's KEV catalog (CC0) and FIRST's EPSS. Certificate transparency: crt.sh. This product uses public data and isn't endorsed or certified by those organizations.