How the scanner works
If you found SiteScanBot/1.0 in your logs, someone entered your website into this tool. Here is exactly what it does, and how to opt out.
What it loads
| The page | The address a visitor entered (usually your homepage), following redirects like a browser would. |
| Standard files | /robots.txt, /sitemap.xml, /.well-known/security.txt, /ads.txt, /llms.txt, /favicon.ico |
| Scripts | A few of the JavaScript files that page already references, to identify libraries. |
| WordPress | The theme's style.css header, the readme.txt of plugins the page references, and /wp-json/. |
| Browser | One rendered visit in a headless browser to take a screenshot. |
What it never does
| No writes | No POST requests, form submissions, logins or password attempts. |
| No probing | No guessing of hidden files (.env, backups, admin paths) and no vulnerability payloads. |
| No crawling | One page per scan, at most ~25 requests, then it stops. |
| No retries | If your site returns 403/429 or a bot challenge, it records "restricted" and backs off for an hour. |
| Rate-limited | A handful of scans of any domain per hour, however many people ask; results are cached. |
It also checks public DNS, RDAP registration data, Certificate Transparency logs and free public APIs (Google PageSpeed Insights, Google Safe Browsing, WordPress.org). None of those touch your server.
Opt out
Site owners can exclude a domain. Opt-outs take effect immediately and cover all subdomains.
Questions or abuse reports: hello@farhan.app