Whitelist the scanner

Firewalls, bot filters and rate limiters often block scanners. Allow the addresses below and Wsec can read your site the way a visitor does. Every request comes from one of these addresses and carries the user agent shown here.

Scanner addresses

User agent

A user agent is easy to fake, so use it for logging and filtering, and do not treat it as proof. The address is what to allow.

Allow-list rules

These are generated from the addresses above. Read them before you paste them in: they match your server's configuration style, not your exact setup.

What the scanner does

Normal scan: about eight requests. The home page over HTTPS, one request to port 80, one CORS test, one or two requests for security.txt, a TLS handshake, and some DNS lookups.
Deep scan: about twenty more requests for well-known paths, spaced a fraction of a second apart. Deep scans only run against hosts whose owner has proved control.
Only GET, HEAD and one OPTIONS request. Nothing is submitted, no forms are filled in, nothing is guessed at, no passwords are tried.
No more than six scans of one host per hour by default, and twelve per hour from one visitor. Hosts with an allow record (below) get a higher per-host limit.
Responses are checked and discarded. The report keeps the findings, a few header values and short excerpts used as evidence.

Allow more scans of your own site

If you own the site and want Wsec to treat it as opted-in (higher per-host rate limit, less “noise” friction), publish one of the following. Removing it restores the normal limit immediately.

DNS TXT (preferred) at _wsec.your-domain:
```
wsec-allow=1
```
Optional contact for abuse reports:
```
wsec-allow=1; contact=security@example.com
```
This can sit next to a wsec-verify=… record used for deep scans — DNS allows multiple TXT values on the same name.
File at /.well-known/wsec-allow.txt on the site, with the same content:
```
wsec-allow=1
```

After the record is live, the next scan of that host uses the higher limit and the report notes that the host has opted in.