Our test traffic

What a test sends

Each request names us in its user agent: NullSquare-Security-Test/1.0 (+https://nullsquare.net/scanner).

A test sends only GET, HEAD and OPTIONS requests, without a body, cookies or credentials, and it follows no redirect. On a site built to web standards, these requests change nothing.

It sends at most 4 requests a second to each site, never more than the number of requests the company approved (for a test that stands for days, a day), and nothing after its time is over or a person at the company stops it.

The closer look

A company can also allow a closer look at its own sites, once, for up to 90 days. Once a day, and within the hour after a new site of theirs appears, it opens a TCP connection to each address the company runs its own sites on, on 21 common ports (21, 22, 23, 25, 80, 110, 143, 443, 445, 1433, 2375, 3306, 3389, 5432, 5900, 6379, 8080, 8443, 9200, 11211 and 27017), and closes it at once. It sends nothing over the connection.

It also asks each of those sites that answers on the web for two files a site must never serve, /.env and /.git/HEAD, and for one page that does not exist, to compare with. These are GET requests with the same user agent as a test.

It opens at most 4 connections a second to each address and at most 400 a day, and never looks at a site on a shared store, a name anyone could take over, or a site the company said not to test. It opens no connection to an address a hosting provider such as Cloudflare or Amazon CloudFront runs a site on, nor to the server of a site the company said not to test: a site a hosting provider runs is only asked for the two files.

Who asked for it

A test goes only to sites under a domain the company proved it owns, and only after a person at the company approved its terms: the sites, the speed, the size and the time.

If a company proved only a subdomain, nothing else of its parent domain is tested.

Where it comes from

We publish the addresses our tests come from on this page before we test any customer's site.

If you did not expect it

If you run a site and see this traffic, but nobody at your company asked for a test, write to [email protected] with the time and the address the requests came from. We can stop that company's tests at once, then we look into it and reply.