How Wobbly scans.
Wobbly reads other people's websites, so the rules matter. This is exactly what a scan does, what it leaves alone, and how to make it stop.
Permission comes first.
Wobbly only scans a site after the person submitting it confirms they own it or have permission to test it. That confirmation is required again on every new site added to the workspace, and a scan without it is refused before anything is fetched.
Read-only, one page at a time.
A scan reads the single public page you submit, and nothing else. Dots never log in, submit a form, create an account, start a checkout, or follow links onwards to other pages of a site.
What a scan reads.
From that one page, a scan collects its public HTML and response headers:
- Response status, response time, page size, and content type.
- The page title, meta description, language, canonical tag, and Open Graph tags.
- Counts of forms, inputs, buttons, links, images, and inline or external scripts.
- Images missing alt text or width and height attributes.
- A HEAD request to at most five images, to catch broken or oversized ones.
- Security headers: Content-Security-Policy, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy.
- Whether third-party analytics or session-recording scripts are loaded.
What a scan never reads.
We don't keep a copy of your page. We keep the findings a scan produced and the short piece of evidence quoted inside each one, so a report stays readable later.
- Passwords, form entries, or anything you would have to type in to see.
- Cookies, sessions, or any area behind a login.
- Private and internal addresses, including localhost, 10.x, 192.168.x, 169.254.x, cloud metadata endpoints, .local and .internal hosts. These are refused before a request is made.
Bounded, never a loop.
Every fetch has a 12-second timeout, with capped page size, capped image samples, and a limited number of redirects. Monitoring runs on the schedule the account chooses, and hourly is the fastest it goes. Free accounts get one full scan; paid accounts can re-run as often as they like, inside the same limits.
Who sees the results.
A scan belongs to the account that ran it. Its findings and score are visible to that person and to admins of that account. Alerts they configured, such as email, Slack, or a webhook, receive a summary. We don't publish reports, sell them, or hand them to anyone else. A report only becomes public if the account holder chooses to share the link.
Don't want your site scanned?
Tell us through the contact page and we'll stop scanning it and delete the runs and findings we hold for it. You don't need an account to ask, and you don't need to give a reason.
What we won't do with a scan.
Wobbly is a quality tool, not a reconnaissance or load-testing service. We don't scan for exploits, test credentials, or generate traffic meant to overwhelm a site. If a scan looks like it is being used that way, we stop it and close the account.