The free GRC Oversight scanner performs only passive, browser-equivalent checks. This page is the policy URL our scanner's User-Agent advertises — here's exactly what it does and doesn't do.
A scan loads your site one time, the way a normal browser does on a first visit, plus a few public-record lookups. It does not crawl, brute-force, fuzz, or attempt to authenticate.
Every request the scanner makes carries an identifiable User-Agent that links back to this policy page:
GRCOversightScanner/1.0 (+https://grcoversight.com/scanner-policy; passive browser-equivalent checks only)The single-GET exposure checks also send this User-Agent and honor your server's responses (a redirect to a login or home page is treated as not-exposed).
The scanner is rate-limited to keep load minimal and prevent abuse. Limits are enforced per source IP and per target host.
Up to 5 scans per minute from a single client IP. Requests over the limit are rejected with a retry-after.
At most 2 scans per minute against the same host, so no single domain is hammered.
If you do not want your site scanned, contact us and we will exclude it. Because the scanner only runs on demand and stays within browser-equivalent traffic, it should never impact a healthy site — but we will honor exclusion requests.
Email us at
security@grcoversight.comGet a guided demo, or start by scanning any domain for free.