Check any public website or domain. Click a tool to run it — no sign-up, no limits beyond the usual fair use.
Click a card to open it, or use the list on the left.
security's exposed-path check runs automatically, with no declaration, for the same reason: for a short list of commonly misconfigured paths it only initiates a GET request and reads the status code that comes back — the response body is never downloaded, saved or cached — and it backs off automatically on sites that answer 200 for everything.exposed runs the same kind of check against a longer list — .env, backups, feed-export scripts and more — plus anything you paste into its own-paths box, and asks you to confirm ownership first, since it's a more thorough scan. It still only initiates a request and reads a status code, never downloading, saving or caching the body, capped at 40 paths per run — for a much bigger list, see the deep scan.ping is HTTP, not ICMP — Workers can't send raw ping packets — so it's the time to get a response header back.