Super Scanner
About our scanner bot
The Super Scanner is a free website check made by WebSuhu. It visits a website only when someone asks for a report on it, reads what any visitor could see, and stops. It never logs in, fills in forms, or follows links around the site.
How it identifies itself
- User agent
- Mozilla/5.0 (compatible; WebSuhu-SuperScanner/1.0; +https://websuhu.com/super-scanner/bot)
- Product token for robots.txt: WebSuhu-SuperScanner. We never pretend to be a browser, Googlebot or anyone else.
- Signed requests (Web Bot Auth)
- Every request carries an HTTP Message Signature (RFC 9421) with Signature-Agent: "https://websuhu.com", signed with our Ed25519 key. The public key is published at https://websuhu-com-hfq0.devsite.samudrahost.com/.well-known/http-message-signatures-directory.
- IP address
- 64.120.94.71
What it requests
- /robots.txt first, then the home page.
- Public files that show versions: the feed, readme.txt of plugins and style.css of themes linked from the home page, and script files the page loads.
- A short list of addresses that should not be public (for example /.env, /phpinfo.php, /wp-content/debug.log), to warn the owner. We only note whether they answer; their content is never stored or shown.
- The home page once more as a visitor arriving from a Google search (desktop and phone), to spot hacks that only show spam to search visitors. Same user agent.
GET requests only, about 30 to 60 per report, sent within a few seconds, once. Nothing is repeated unless someone asks for a new report.
robots.txt
The scanner follows robots.txt (RFC 9309). It uses the group for WebSuhu-SuperScanner, or the * group if there is none. A disallowed path is not requested; if the home page is disallowed, the report says so and no outside scan is made. To keep it away entirely:
User-agent: WebSuhu-SuperScanner Disallow: /
Allowing it through a firewall
If your firewall (Cloudflare, Sucuri, a host WAF) challenges the scanner and you want a report, allow the IP address 64.120.94.71, or verify the Web Bot Auth signature against our key directory above. The owner of a site can also run the deep scan from inside the site instead, which needs no firewall change.
Questions or a problem
Email halo@websuhu.com with your domain, and we will look into it, or stop scanning it on request.