What a Deep scan does, and why it asks for proof
How a Deep scan looks further than a Pulse, and why Lockpick only runs one on a site you've shown you control.
A Pulse reads your site the way any visitor could. It loads a few pages and checks what they reveal.
A Deep scan goes further. It reads up to 30 pages, follows the scripts your site loads and tries a careful set of harmless requests against the parts of your site that could expose data, for up to 8 minutes.
Why Deep asks for proof
Those extra requests are the kind a site owner might not expect from a stranger. Running them against someone else's site without asking isn't fair, and in many places isn't legal.
So before your first Deep scan on a site, Lockpick asks you to prove you own it. You add one short value to your domain's DNS, your homepage or a small file, once. Every Deep scan and Deep auto-check looks for it again before it starts, so removing it stops them.
What Deep never does
It never signs in, never changes anything on your site, never tries to break in and never reads your code. Every request is logged, limited and shown in the report, so you can see exactly what was checked.
Was this helpful?
How attackers find your site in the first place
Most attacks aren't personal. Automated tools scan the whole internet, and small sites get found the same way as big ones.
Letting your AI fix things safely
How to hand a finding to your coding assistant so it fixes the right thing, and how to check its work.