Free security checker terms
The free checker is operated by PatchAndShip, based in California. Our free security checker (patchandship.com/check.html) runs an automated, passive check of a website you name.
- Authorization. Only check a site you own or are authorized by its owner to test. By ticking the box you confirm this for each check, and Section 12 (Indemnity) of our Terms of Service applies.
- What it does. The checker loads the site's homepage, up to 10 JavaScript files that page links to, and its response headers, the way a web browser does. It does not log in, query databases, request unlinked paths, or change anything.
- Acceptable use. Don't use the checker on sites you're not authorized to test, don't automate it or get around its limits, and don't use, test or share any key, secret or weakness it reveals.
- No warranty. Results are automated, may be incomplete or wrong, and are provided "as is" for information only. They are not a penetration test, an audit or a guarantee of security (see Section 6 of our Terms of Service). Section 11 (Limitation of liability) applies.
- Our rights. We may limit, pause or stop the checker, or block checks of any site, at any time. If you own a site and don't want it checked, email patchandship@gmail.com and we'll block it.
Free checker privacy
What we collect: the web address you enter and your IP address. We use the address only to run the check and show you the result in your browser. We do not store results, page contents, or any key or secret the check finds. We keep a short log entry (the domain checked, the time, the consent version, and the types of issues found, such as "missing security header") to prevent abuse and improve the service. To enforce rate limits we keep a keyed one-way hash of your IP address for up to 24 hours.
Who we share it with: Vercel hosts the website and the checker (Vercel also records request details, including IP addresses, in its own logs).
How long we keep it: Free-checker log entries are kept for up to 1 day, and rate-limit counters expire within 24 hours. Never paste passwords or keys here. Full details: Privacy Policy.