About our crawler

RemedyProof performs a small, fixed set of read-only checks against websites whose owners or authorized agencies have explicitly asked us to monitor them. We check public configuration: DNS records, TLS certificates, whether HTTP upgrades to HTTPS, and a small number of HTTP response headers.

Specialist checks use only product-derived DNS names: the host for MX and SPF, _dmarc., _mta-sts. and _smtp._tls. TXT names, plus the A/AAAA lookup needed before a pinned connection. Certificate-transparency evidence is collected from the pinned TLS handshake and the embedded leaf certificate extension. WordPress inventory uses HEAD / and, only after an official API link is observed, a fixed GET to /wp-json/.

We only contact hostnames that a customer has added to an authorization receipt AND proved technical control of with a DNS TXT record. A hostname we merely discovered is never contacted.

• It never sends POST, PUT, PATCH or DELETE. Only GET, HEAD and OPTIONS.
• It never submits forms, uploads files or sends a request body.
• It never attempts authentication, default credentials or password guessing.
• It never sends SMTP traffic, queries CT providers, or infers WordPress versions, CVEs or vulnerabilities.
• It never crawls. It requests a small number of fixed, rule-owned paths.
• It never scans ports. Only the default port for HTTP and HTTPS.
• It never runs exploits, payloads, fuzzing or vulnerability probes.
• It never executes JavaScript or drives a browser.

Our requests carry this User-Agent:

ProofOfFixBot/1.0 (+https://remedyproof.com/bot)

Every request we make is also recorded against a specific rule and a specific job, and the customer who authorized the monitoring can see that log in their account.

A monitored property receives a small number of requests per scheduled run, subject to a hard per-run budget. We do not retry aggressively and we do not run concurrent scans against the same property.

If you believe we are contacting a site without authorization, tell us the hostname, request time and source IP. We will stop the property immediately while we investigate. We can also activate a fleet-wide kill switch that revokes active scanner egress.

Abuse contact: abuse@remedyproof.com

Scanner source identity: scanner.remedyproof.com (the approved forward and reverse-DNS name for the current scanner egress; its address may change when infrastructure is replaced). Include the source IP and request time from your logs when reporting abuse.

These checks describe what our deterministic rules observed at a point in time, and whether those observations changed. They do not prove a website is secure, do not certify compliance with any standard, and are not a penetration test.