# What a Deep scan does, and why it asks for proof

How a Deep scan looks further than a Pulse, and why Lockpick only runs one on a site you've shown you control.

A **Pulse** reads your site the way any visitor could. It loads a few pages and checks what they reveal.

A **Deep** scan goes further. It reads up to 30 pages, follows the scripts your site loads and tries a careful set of harmless requests against the parts of your site that could expose data, for up to 8 minutes.

## Why Deep asks for proof

Those extra requests are the kind a site owner might not expect from a stranger. Running them against someone else's site without asking isn't fair, and in many places isn't legal.

So before your first Deep scan on a site, Lockpick asks you to **prove you own it**. You add one short value to your domain's DNS, your homepage or a small file, once. Every Deep scan and Deep auto-check looks for it again before it starts, so removing it stops them.

## What Deep never does

It never signs in, never changes anything on your site, never tries to break in and never reads your code. Every request is logged, limited and shown in the report, so you can see exactly what was checked.

> **Good to know**
>
> If you're not sure which one you need, start with Pulse. Deep is for sites you run where you want the fuller picture.

> **Try it**
>
> [Check a site](/app) and choose Deep. The **Prove you own** sheet walks you through the proof step by step for your DNS host.