Enter the homepage of a site you own or are authorised to test. WebStatBot will follow its links (up to 200 pages) and report what it finds — nothing is sent to the site beyond ordinary page requests.
robots.txt once and respects it for every page and path it checks. A page it forbids is never requested..env or .git/config) answers with HTTP 200, and whether common security headers are present on the homepage. For that path list, each check only initiates a GET request and reads the status code — the response body itself is never downloaded, saved or cached. It first checks a random path that can't exist; if that also answers 200 (a “soft 404”), the whole check is skipped rather than risking a false result.GET requests and reads status codes, headers and links — it never submits a form, tries a password or sends anything designed to trigger an error. Ordinary crawled pages are read only to extract links from the HTML; nothing beyond those links is stored or shown.Site scans are limited per address per day. A crawl can take a few minutes for a large site.