Check my site

The ShieldWave scanner and domain exclusion

Version of 22 October 2026

1. What the scanner is and who runs it

ShieldWave (https://shieldwave.io) checks the security of websites from the outside. It is run by Radosław Fedorczuk, trading as ENSOMEDIA Radosław Fedorczuk, ul. Chorwacka 33/42, 51-107 Wrocław, Poland, tax number (NIP) 8952195742, EU VAT number PL8952195742, business register number (REGON) 381626230, entered in the Polish Central Register and Information on Economic Activity (CEIDG), "ENSOMEDIA" or "we" below.

2. How the scanner identifies itself

The scanner uses the User-Agent ShieldWave-Scanner/1.0 (+https://shieldwave.io/bot).

Every request carries this identification. The headless browser that loads the page like a visitor sends a Chrome User-Agent with ShieldWave-Scanner/1.0 (+https://shieldwave.io/bot) appended at the end. When a site refuses the scanner, the check is reported as not assessed and no request is repeated under another identity. Blocking the identification does not stop a check that has started: its requests are refused and the parts that need the site's answers are reported as not assessed. To have your domain excluded from all checks, see section 5.

Anyone can copy it; if in doubt, send us the time, IP address and log line and we will say whether the request was ours.

3. What a check does to a site

A check reads what the server returns (pages, security headers, certificate, cookies, caching) and asks for typical addresses of forgotten files. Depending on the platform it also checks the WordPress configuration. Forms, redirects and known vulnerabilities are checked only by the full set, described below.

A check ordered from an account sends test inputs to forms and addresses only when the customer has confirmed control over the domain (a DNS record, a file, a meta tag or a connected WordPress plugin). That is more than reading. Without that confirmation it runs the shorter set and stops when the site refuses it. The demonstration check and the four free tools, open to anyone without an account, run a shorter set: they read what the server returns and send no test inputs to forms; the demonstration check also asks for a short list of addresses of forgotten files.

The full set also asks for the home page three times in a row, to see whether search engines are shown different content than visitors (hidden spam, cloaking). The first request is the ordinary one, with the Chrome User-Agent described in section 2. The second is the same request with the header Referer: https://www.google.com/, as if the visitor came from Google search. The third carries the User-Agent Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) ShieldWave-Scanner/1.0 (+https://shieldwave.io/bot). That request is not from Google. You tell it from Google's crawler by the ShieldWave-Scanner/1.0 part at the end of the User-Agent, which Google's crawler never sends, and by the address: Google's crawler comes from addresses that Google publishes and that resolve back to googlebot.com or google.com in a reverse DNS lookup. No other page is requested for this check; only redirects within your own domain are followed, at most three.

A check does not log in, unless the customer gave login details for the part behind the login, and does not change content, though a test input sent to a form can reach you, for example as a contact-form message. We limit the pace of requests and the number of checks one account and one IP address can order. Checks run only when a customer orders them, on a customer's schedule, or when someone uses the demonstration check.

4. Who may order a check

From an account, a customer may check only a site that is theirs or whose owner allowed it. The customer states this when adding a site or ordering a check; we record the statement with the account, the domain, the time, where it was given, the IP address and the browser identification, and keep it for 3 years from the statement. The full set runs only after a technical confirmation of control over the domain (DNS record, file, meta tag or connected plugin); we may also ask for proof of the owner's permission.

Checking a site without permission breaks our Terms of Service and can be an offence, such as unauthorised access to a computer system or disrupting its work, under Polish criminal law (Articles 267 to 269c of the Penal Code) and the corresponding laws of other countries.

5. How to exclude your domain

A site's owner can have the domain excluded from all ShieldWave checks, free and without giving reasons. Write to support@shieldwave.io from an address at that domain, subject "Domain exclusion", saying whether subdomains are included. From another address, add other proof of control, such as a DNS record or a file with a text we give you.

We exclude the domain within 2 working days of a complete request, confirm it by e-mail and keep it on our exclusion list, which covers all customers' checks, the demonstration check and the free tools. To lift the exclusion, write from the same domain.

6. How to report misuse

If you believe someone checked your site through ShieldWave without permission, write to support@shieldwave.io with the domain, the date and time (with time zone) and, if you have them, the IP address and log line. We will check who ordered the check, may ask them for proof of permission, block checks of your domain and suspend their account, and will tell you what we did. We disclose a customer's data only where the law allows. Report weaknesses in ShieldWave itself under Vulnerability Disclosure.

7. What happens to the results

The results go to the person who ordered the check, in their account or browser. We do not publish results ourselves.

8. Change history