About this scanner

Janus is a passive external scanner. This page explains exactly what it does, what it deliberately does not do, how often it makes requests, and how to opt out or block it if you'd rather it left your domain alone.

What we check

• The TLS certificate and negotiated protocol/cipher on your public HTTPS endpoint.
• HTTP response headers like Content-Security-Policy, Strict-Transport-Security, and cookie flags.
• DNS records: SPF, DMARC, and DNSSEC.
• A small, fixed list of publicly-visible software/version identifiers (e.g. a Server header) cross-referenced against known CVEs.

What we don't do

• No exploitation attempts, no injection payloads, no fuzzing — every check reads publicly-served responses, it never tries to trigger a vulnerability.
• No login attempts, credential stuffing, or any request requiring authentication.
• No load or denial-of-service style testing — request volume per target is small and bounded (see below).
• No scanning of pages or paths that require you to be signed in.
• No storing of anything beyond the scan target's domain and the check results themselves — no personal data is collected.

Request rate & frequency

Anyone can submit at most 5 scans per hour per IP address. Across every user combined, this system runs at most 5 scans at once and starts at most 30 scans per minute. A single scan makes a small, bounded number of requests to your domain — one TLS handshake, one HTTP request for headers, a handful of requests to well-known paths for software fingerprinting, and a few DNS lookups — all completed within roughly 20 seconds, then nothing further until (and unless) someone requests another scan of the same domain.

How to opt out

Add the following DNS TXT record to your zone, and every future scan of your domain will be refused before we make any request to it:

_janus-opt-out.yourdomain.com. TXT "true"

This is checked fresh on every scan attempt (including redirects, at each hop), so it takes effect as soon as the record propagates — no need to contact us. The only exception is a domain whose owner has proven ownership through our verification flow and specifically requested a deeper scan of their own domain.

How to block by User-Agent

Every request this scanner makes identifies itself with a distinct, self-describing User-Agent header — by default something like JanusSecurityScanner/1.0 (+https://.../about-this-scanner) — that always links back to a page like this one. You can block or rate-limit it in your WAF, a robots.txt-style user-agent rule, or a firewall rule matching that string, in addition to (or instead of) the DNS opt-out record above.

Report a problem

If this scanner has caused you an issue, or you have a concern that isn't just "stop scanning me" (the DNS record above handles that immediately), tell us here: