Our scanner

Who runs it

FourWinds Digital, a business in Ireland that builds and runs software for small businesses. The scanner is part of our client portal. It runs when one of our clients asks us to check their own domain, and weekly after that, or when we check a domain before talking to a business about it.

What it reads

Only what any visitor can see, from a browser in Dublin:

• The domain's public DNS: mail servers, SPF, DMARC and MTA-STS, and the MTA-STS policy file if one is published.
• The website over HTTPS: the certificate, the redirect from plain HTTP, and the security headers.
• When the domain's registration expires.
• The homepage in a browser: the cookies and tracking requests made before a visitor chooses anything, whether a cookie banner appears, and an automated accessibility test.
• The privacy notice linked from the homepage.
• Five common admin login addresses (/wp-admin/, /wp-login.php, /administrator/, /admin/ and /user/login), one request each, to see whether a login page answers.

Apart from those addresses it loads the homepage and the privacy notice, nothing else. It sends no forms, tries no passwords and follows no other links.

What it keeps

A dated record of what it saw, with a screenshot of the homepage, the list of requests the page made and the cookies it set. Each record is hashed so it cannot be changed later without that showing. Records are kept for two years, and the screenshots and request lists for thirteen months. A record about a client's domain is shown to that client in their portal.

Asking it to stop

Email hello@fourwindsdigital.com with the domain to have it taken off the scanner. If you own the domain, the same email gets you a copy of what the scanner recorded about it.