For website operators

You see ZwoWebCheck in your server logs? Then someone checked your website with our free checking tool. Here is what happens during a check.

How to recognise us

Our requests send the user agent:

ZwoWebCheck/0.1.0 (+https://zwocheck.de/web/info)

What a check fetches

• DNS records of the domain (via our own resolver) and one query for the SOA record sent directly to each name server.
• The entered address over HTTP and HTTPS including redirects, plus the start page of the variant with or without www.
• First /robots.txt, only to detect an opt-out for ZwoWebCheck (see below).
• /.well-known/security.txt – no other paths.
• One TLS handshake (if the name has several IPv4 addresses, one each to the first two) and up to six short connection attempts that only offer outdated protocols or weak encryption and stop after the server's first answer.

That is at most 26 connections in total. We do not try out paths, submit forms, log in anywhere or look for vulnerabilities. We check the same website at most every 10 minutes – unless someone explicitly asks for a new check; the number of checks per visitor is limited as well.

Opting out

If you do not want your website to be checked with ZwoWebCheck, you can say so yourself. We look before every check and stop without fetching anything else. Either of the two ways is enough.

Via DNS, for the whole domain including subdomains (for a single host, add the record under _zwocheck.<host>):

_zwocheck.example.com.  TXT  "v=zwocheck1; opt-out"

Or in the host's robots.txt:

User-agent: ZwoWebCheck
Disallow: /

We do not apply rules for User-agent: * here, because a check is a single request triggered by a person, like a browser visit. If you remove the entry, it takes effect within 10 minutes.

If you can change neither DNS nor the web server, write to us at info@zwobyte.de. We will then exclude the domain.