Does your API advertise methods that change data?

This check asks your API routes which request methods they accept, with one polite preflight request, and notes routes that list methods that create, change or delete data.

What does this check look at?

It looks at whether an API address, when asked which methods it accepts, lists ones that create, change or delete data. A Deep scan never signs in, never changes anything on your site, never tries to break in and never reads your code.

Only a Deep scan runs it, after you prove you own the site.

What does a result mean?

Nothing is ever written, so it does not show that a change works without sign-in. A clean result means nothing was found in what the scan read. It does not prove the problem is absent from parts the scan never sees.

How serious is a finding?

This is information only. It claims no weakness, so it carries no verdict, and you decide whether anything should change. Confidence starts low, because it is inferred from headers or declarations rather than shown directly. The report lists what to fix by how directly someone could use it, not by the severity label.

Which standards does it relate to?

Each one is a related control, not a verification. A scan sees what anyone online can see, so it never proves a whole requirement is met.

Fix it with your AI

Trim the methods to what each route implements, and test that writes are refused without a session.

My API routes advertise write methods (POST, PUT, PATCH or DELETE) in their Allow or Access-Control-Allow-Methods headers. For each route the report names, check which methods it really implements, return 405 for the rest, and limit Access-Control-Allow-Methods to what my own front end needs. Then add a test per write method that sends it without a session and expects 401 or 403.

How to check

Say Atlas, our example app at atlas.example, allows every method on its API by default. A Deep scan notes the declared write methods, and the team confirms each requires sign-in.

Deep scans come with the Deep plan, and pricing shows what it includes. Pulse or Deep explains what each scan reads, and the full list of checks shows the rest.