How we check
Lockpick reads what anyone online can see about your site, within fixed limits, and reports only what it saw.
Lockpick checks your site from the outside, the way a stranger or an attacker would find it. Every check reads what your site already shows the public, plus public records about your domain, and nothing else.
Within fixed limits
Each kind of scan has a fixed budget it can't exceed.
| Pulse | Deep | |
|---|---|---|
| In plain words | A quick outside look, the way a stranger or a bot sees your site | A careful walk through your site, the way a determined attacker would |
| What we look at | The homepage and the files it loads, email sender settings (SPF and DMARC), security headers and TLS, and public DNS, certificate and subdomain records, in at most 10 requests. | Up to 30 readable pages and 20 scripts, files that should not be public, admin areas, and your API if you have one. If your site builds its pages in the browser, the report says how much Deep could read. |
| How long | Usually under 15 seconds | 2 to 8 minutes |
| Needs proof you own it | No, just confirm you're allowed | Yes, a DNS record, a meta tag or a file, kept published |
- A Pulse sends at most 10 requests to your site and a Deep scan at most 200.
- Requests are spaced out, and a scan stops early if your site slows down, fails or refuses.
- Reading DNS records, certificate logs and domain registration never touches your site.
Only what we saw
A finding is only reported with the evidence that shows it. A report says what each part of the scan could read, and anything it couldn't check is marked as not checked, never as passed. How we rate findings explains severity, what a confirmed finding has to show and what checking again can prove.
Your permission first
Every scan starts with your confirmation that you own the site or are allowed to test it. A Deep scan also needs proof of ownership and your approval each time.
Was this helpful?