Pulse or Deep
Pulse is a quick outside look at your site, and Deep is a careful walk through it once you prove you own it.
Lockpick has two kinds of scan. Both look only at what anyone on the internet can see, and neither one changes anything on your site.
| Pulse | Deep | |
|---|---|---|
| In plain words | A quick outside look, the way a stranger or a bot sees your site | A careful walk through your site, the way a determined attacker would |
| What we look at | The homepage and the files it loads, email sender settings (SPF and DMARC), security headers and TLS, and public DNS, certificate and subdomain records, in at most 10 requests. | Up to 30 readable pages and 20 scripts, files that should not be public, admin areas, and your API if you have one. If your site builds its pages in the browser, the report says how much Deep could read. |
| How long | Usually under 15 seconds | 2 to 8 minutes |
| Needs proof you own it | No, just confirm you're allowed | Yes, a DNS record, a meta tag or a file, kept published |
Pulse
A Pulse looks at your site the way a stranger or a bot would. It reads your homepage, a couple of the scripts it loads, your email settings, your security settings and public records about your domain.
- It sends at most 10 requests to your site. Reading your public DNS records and certificate logs doesn't count, because those never touch your site.
- You only need to confirm you own the site or are allowed to test it.
- Every plan has it. The Free plan includes 5 Pulse scans a month.
Deep
A Deep scan walks through your site the way a determined attacker would. It reads up to 30 pages and 20 scripts, looks for files and admin areas that should not be public, and checks your API if you have one.
- It sends at most 200 requests and stops after 8 minutes.
- It needs proof that you own the site: a DNS record, a meta tag or a file, added once. It keeps working for as long as the value stays published.
- You approve each Deep scan before it starts.
- Deep comes with the Deep plan, which includes 20 Deep scans a month for $19 a month, or $190 a year. The Free plan has no Deep scans.
Which one should I run?
Start with Pulse. It finds the gaps most sites have, usually in under 15 seconds, for free. Run Deep when you want to know what someone could find by exploring your whole site, such as exposed files, forgotten admin pages or an open API.
Was this helpful?