What this does, and what it will not do

What it reads

Your home page over https, the old http address, a made-up address (to learn what your site does with one), a short list of files that should never be public, and your domain's public email records.

About a dozen requests, four at a time, then it stops. Every one is a plain GET — the same thing a browser does when someone visits.

What it will not do

It never logs in, never posts anything, never guesses a password, and never tries to break anything. It will not check an address on a private network, and it will not check a site on an unusual port.

If it finds a file that should not be public, the report says what it found and not what was in it. Copying somebody's secrets into a report is publishing them a second time.

Who it says it is

Requests arrive with BBA-SafetyCheck/1.0 in the user-agent and a link back to this page, so anyone reading their own logs can see exactly who it was.