How our scanner works
Pewterkit Check reads only what a visitor's browser would load from your site, once, when someone asks for a check.
Who runs it
The scanner is part of Pewterkit Check. It runs only when a person enters a site address and asks for a check, or when a customer asks to re-check a site they bought fixes for. It does not crawl the web on its own.
Our user agent
Every request from the scanner identifies itself with this user agent:
PewterkitCheck/0.1 (+https://pewterkit.com/bot)
What it reads
- the page you entered, following its redirects,
- the same-site scripts that page loads, and their source maps when the scripts point to them,
/robots.txt,/sitemap.xmland/llms.txt,- one made-up address, to see how your site answers a missing page (a 404 check),
- the plain
http://address once, to see that it moves visitors to https, - a few public files apps use, such as the web app manifest, the preview image your page names, and the app-link files in
/.well-known/, - a few of your app's own page addresses, to see that deep links load,
- your builder's preview address, to see whether a duplicate copy of your site is still live.
It also looks up public records about the domain: DNS records, registration details (RDAP) and public certificate logs. These lookups go to public services, not to your server.
How much it asks for
One check is one scan: a few dozen small requests, sent once, with every download capped in size and every request stopped after 10 seconds at most. Starting many checks in a few minutes from one address is limited.
Deeper checks
Deeper checks, such as database rules and private files, are on the way. They will run only after the site owner confirms the site with a DNS record or a file we give them, and they will read counts and sizes only, never contents. Until then, every check reads public pages only.
Opt out
To have your site excluded from checks, email hq@pewterkit.com from an address at your domain (or tell us how to confirm the site is yours) and name the domain. We add it to our do-not-check list, and checks of that domain stop.
Report a problem
Seeing traffic you think is ours that does not match this page? Email hq@pewterkit.com with your domain, the time and the user agent you saw, and we will look into it.