Prove you control a site
The normal scan reads the same things a browser does. The deep scan asks for files such as /.git/HEAD and /.env. That is only polite to do on a site you run, so Wsec asks for a small proof first.
Add one of these
The value is the same every time for this host, so you can leave the proof in place. Wsec checks it again at the start of each deep scan, so taking it down withdraws permission.
Option 1: a file
Serve this text at on that exact host:
Option 2: a DNS record
Add a TXT record:
| Name | |
|---|---|
| Type | TXT |
| Value |
DNS changes can take a few minutes to show up.
Why this exists
Without it, anyone could point a scanner at a site they do not run and have it probe for backups and secrets. Both proofs need control of the site's files or its DNS, so they do the job. The file must be on the same host you entered, so a redirect to another host does not count.