Acceptable use

It requests pages the way any browser would, and reads what the server voluntarily returns — headers, the certificate, cookie flags, public DNS records, page content. Nothing more. It does not try to get in, does not submit credentials, does not test for exploitable weaknesses, and does not modify anything.

That is why running it is not an attack, and why a scan of someone else's public homepage is closer to visiting it than to probing it. It is still not something to do uninvited.

• Scan a website in order to find a way to attack it, whether or not you own it.
• Use the service to harass, pressure or embarrass a site owner, including by mass-scanning and publishing results as a sales tactic.
• Try to get around rate limits, blocks, or the daily scan cap — including through multiple addresses or automation.
• Point the scanner at infrastructure that isn't a public website: internal hostnames, private address ranges, cloud metadata endpoints, or anything behind a VPN.
• Use the service where doing so would break the law where you are, or where the target is.
• Resell scans or reports as your own service.

Scanning a prospect's website to start a conversation is the obvious use of a tool like this, and we would rather be honest about it than pretend otherwise. Be straight with people: tell them you ran a check, show them the report, and stop if they ask you to. Using a security finding as leverage rather than as information is the line, and it is not a fine one.

We rate-limit every requester, maintain a blocklist of hostnames that must not be scanned, and reserve the right to block any user or target without notice. Checks that go beyond passive reading are gated behind proving you control the domain.

If you believe someone is using TitanScan Pro against you, write to support@titanscanpro.com with the date, your domain, and anything you saw in your logs. We keep enough records to investigate and we will act on what we find.