Scan authorisation
The essential point in one sentence
Only check domains that you operate yourself or that you have been commissioned to check. If you are unsure whether you may check a domain, clarify it beforehand with the person or body that operates it.
This is an English translation provided for information. The authoritative text is the German version, Nutzungsregeln für die kostenlosen Scanner (German); in the event of any difference, that version applies. Mandatory consumer rights remain unaffected. The legal references below name German provisions.
1. Provider and current service
Wolf-Agents, proprietor Eduard Wolf, Vorderhainberg 21, 94496 Ortenburg, Germany; info@wolf-agents.com; +49 151 46533415
These terms cover free public Web, Email and API Security Checks and their browser findings in German and English. The check costs EUR 0 and concludes neither a report purchase, account nor subscription. Language and context selection do not change measurements.
A fixed file and archive selection may subsequently be purchased separately in the report portal: HTML, PDF, DOCX and CSV in German and English, three calendar years from agreed first availability, including the legal contexts available within the fixed edition at purchase. Price, tax, selection, private permission and any monthly contract are shown there before a binding order. Public examples and free file access already promised under earlier terms retain their original lifetime.
Earlier agreements and rights remain in force. The separate private test-email beta has its own service and processing agreement; these scanner terms replace neither that order nor a private export and archive permission.
2. Preparation, conclusion and delivery
The form names the target to be checked and links these terms. “Prepare check” only prepares the specified free individual check: we verify the security check, volume limits and the target and hold a time-limited offer. No contract is concluded yet; nothing is measured and no file is issued.
The overview shows the tool, target, acceptance deadline, these terms and the withdrawal information. There you can cancel, or use “Back to the form” to correct the target and prepare again. You can accept the offer until the displayed acceptance deadline: a few minutes for the Web Check, just under 24 hours for the Email and API Checks, from preparation. Reopening the overview does not extend it.
By selecting “Order free check and save confirmation” you accept the offer and confirm that you may check the target (section 3). This concludes the service agreement for this individual check. Immediately afterwards we transmit the contract confirmation to your browser, with the order details, time of acceptance, measurement start deadline, these terms and the withdrawal information, as a text file (TXT). The view then remains open; there you can read the contract confirmation and save it again without time pressure. The contract confirmation is not a check result.
The measurement only begins when you select “Start check now”: in the view after acceptance or on the page that the result link in the contract confirmation shows before the measurement has begun. Merely opening this link, including by an automatic link preview, and the passage of time do not start a measurement. You can start it until the measurement start deadline, which is set on acceptance and stated in the view and in the contract confirmation: five minutes after acceptance for the Web Check, until 24 hours after preparation for the Email and API Checks. The API Check can only be started in the browser you used to order it. After the measurement start deadline, this order can no longer start a measurement; you can prepare a new check to run one. Closing the view starts no measurement and does not withdraw the order.
The check produces a snapshot, with no ongoing monitoring. The browser flow requires a current browser with JavaScript and internet access. Downloaded files can be used in a PDF reader, a DOCX word processor or a CSV/spreadsheet application, and the contract confirmation in any text editor. Security checks and volume limits protect against abuse and excessive load.
An accepted scan order is stored until 24 hours after preparation. Browser results generally remain available for seven days after storage, or 15 minutes for technically unreliable results. Reopening does not extend this period. The free check includes neither a long-term archive nor new free report-file delivery. A timely confirmed purchase preparation lasts at most 15 minutes; acquired report archives have their own term in the purchase contract. Statutory performance and warranty rights remain unaffected.
An optional result email contains a link to the existing result. It does not extend the period or create a new check. Newsletter consent is separate, voluntary and may be withdrawn at any time. Personal data is processed as described in the privacy information, without requiring blanket consent to that policy.
3. Authorisation and measurement limits
Only check targets you operate or have been authorised to check; by accepting you confirm this authorisation. Resolve any doubt before accepting. Do not bypass security or volume limits, exploit vulnerabilities or make false or misleading claims about other systems based on the results.
The tools make limited external requests, such as HTTP requests, TLS or SMTP connections and public DNS queries. Each tool describes its scope. There is no sign-in to protected areas, penetration test, complete source-code inspection or exploitation of vulnerabilities. The Web Check compares HSTS preload status locally against a fixed, versioned Chromium list; the target is not sent to third parties for this. DNS queries may reach operators outside the EU; the privacy information explains recipients and limits.
A report documents the settings actually observed and the limits of that measurement. It is not a certificate, seal or proof of complete security or legal compliance, and it does not actively protect a system. Incorrect assessments and undetected problems are possible. A good assessment only covers the stated scope and time. Statutory claims for defective performance remain available.
4. Use of files and link access
You may download and print files generated for your authorised target, use them for your own information and documentation, including professional or commercial work, and share them within your organisation. For a commissioned check you may share the report with your client and people engaged to carry out the technical work. Preserve attribution, measurement date and limitations; identify your own changes. Identified third-party content remains subject to its own rights. Other uses permitted by law remain unaffected.
This does not grant white-label, resale or general publication rights to protected Wolf-Agents content. Lawful quotations and your own technical conclusions remain possible. It does not define any future separate commercial service.
Public results use hard-to-guess links. Search-engine exclusions are not access controls: anyone with the link can read the result during its availability period. Share links and files only with intended recipients and respect third-party rights and data. There is no searchable public result archive. Private test-email files have separate access protection.
5. Rights, liability and termination
Liability follows the law. In particular, liability for intent, gross negligence, injury to life, body or health, and mandatory statutory liability remain unlimited. Free provision and the beta label do not exclude liability.
Statutory consumer rights remain available. Notice: a statutory warranty right exists for digital content and digital services; these terms, free provision and the beta label do not restrict it. We do not treat this service as outside consumer law merely because there is no price. Newsletter consent is not payment. Data-protection rights and withdrawal of consent remain independent of the service agreement.
The individual agreement does not renew automatically. Where there are concrete indications of abuse, the provider may reject further requests and take necessary protective measures. Statutory termination, defect and other rights remain unaffected. Use the contact details above for complaints or other requests; no specific support response time is promised.
6. Contract text, version and language
Technical steps to conclude the contract: enter the target and select “Prepare check”; review the details in the overview; select “Order free check and save confirmation”. You can spot input errors in the overview, which shows the bound target, and correct them before the last step via “Back to the form” and a new preparation. After the contract is concluded, you start the measurement separately with “Start check now” (section 2).
After acceptance we store the contract text, meaning the contract confirmation with the order details and this version, as long as the order or its result is stored (without a result, until ten minutes after the order ends), at most seven days from result storage. During that time you can retrieve it again via the link in the contract confirmation, before the measurement has begun also on the page behind the result link and afterwards from the result page; afterwards it is no longer available from us, so keep your file. The current version of these terms is also available at wolf-agents.com/en/legal/scanner-rules/.
This edition applies only to new offers explicitly issued under it. Prepared offers and accepted orders under versions 1.4, 1.5 and 1.6 retain their original terms, file promises and deadlines. Stored contract confirmations are not regenerated.
The contract language is German; the German version is the primary version. Equivalent English information is supplied for the English flows offered. Language choice does not restrict mandatory consumer rights. We have not subscribed to any particular code of conduct. Language is not a country or participant admission decision for the private test-email service.
Withdrawal information and Withdraw from contract · Privacy information
§ 7 Information for the holder of a checked domain
§§ 1 to 6 are addressed to the person who starts a check. This section is addressed to the holder of a domain that has been checked. This section provides public information about processing data not collected from you (Art. 14 GDPR). It does not replace any individual notice required in a particular case.
(1) Controller: The controller within the meaning of Art. 4 (7) GDPR is Wolf-Agents, owner Eduard Wolf, Vorderhainberg 21, 94496 Ortenburg, Germany, info@wolf-agents.com, telephone +49 151 46533415. No representative under Art. 27 GDPR has been appointed.
(2) Data protection officer: No data protection officer has been appointed; the conditions of § 38 BDSG (German Federal Data Protection Act) are not met. Please address data protection questions to the address in paragraph 1.
(3) Purposes and legal basis: The purpose is to provide the person carrying out the check with the requested result on the security configuration of the domain entered. The former recurring platform checks have been disabled. The legal basis is Art. 6 (1) (f) GDPR in conjunction with recital 49 GDPR.
(4) Legitimate interest: It lies in providing the checking tools in order to promote network and information security; for the access log and the prevention of misuse, additionally in operational security.
(5) Categories: What is processed is what the checked server or a public directory serves of its own accord — the domain name and the associated IP addresses, HTTP response headers, details from the TLS certificate, public DNS records and the third-party resources embedded in the HTML served. Where any of this can be attributed to a natural person — a name in a certificate, for instance — it constitutes personal data.
(6) Source of the data: The information does not come from you but from publicly accessible sources: the checked server when it is retrieved, the public DNS and the public directories named in paragraph 7. The retrieval is triggered by the person who starts the check; which domain is checked is not decided by the provider.
(7) Recipients: Recipients include the operators of tested targets and DNS services. HSTS preload status is compared locally against a fixed, versioned Chromium list; the domain is not sent to third parties for this. The former monitoring blocklist and certificate transparency queries to crt.sh have been disabled; the free scanners and private testmail flow do not query these blocklists. Section 8 of the privacy information describe the recipients, transmitted data, documented transfer grounds and remaining limits of that information.
(8) Storage period: A preparation that is not accepted lapses after five minutes for the Web Security Check, otherwise after 24 hours; an accepted order is kept until 24 hours after its preparation. Results of all three checks are kept for seven days, or 15 minutes for technically unreliable results, from storage of the result. The contract confirmation of an accepted order names the domain and remains retrievable as long as the order or result is stored; without a result, until ten minutes after the order ends. Scan summaries and the domain register are no longer updated; existing legacy records expire under their previous age rules (90 or 400 days, domain register 24 months from the last check) unless deleted earlier in a separate step. Web server logs rotate daily, with 14 completed files in addition to the current file. A deliberately created private domain baseline copy has the fixed order period described in section 6 of the privacy information; additional messages, report revisions and re-entry do not extend it. Other events, email and backup copies have separate rules; expiry of the request does not make all remaining data anonymous. Sections 3–6 and 10 of the privacy information explain the periods, starting events and limits.
(9) Your rights: Subject to the applicable statutory conditions, you have the right of access (Art. 15 GDPR), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18) and to data portability (Art. 20), as well as the right to object to the processing on grounds relating to your particular situation (Art. 21 GDPR). Please contact the address in paragraph 1 for this purpose. If you object to future checks of your domain, we verify authority and scope and then exclude the domain from future public checks (privacy information). The processing is not based on consent; there is therefore no right of withdrawal under Art. 7 (3) GDPR.
(10) Right to lodge a complaint: You may lodge a complaint with a supervisory authority (Art. 77 GDPR). The competent authority is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.
(11) Automated decisions: No automated decision within the meaning of Art. 22 GDPR takes place. The grade awarded assesses the technical configuration of a domain as it is measurable from the outside; it does not entail a legal effect or a similarly significant impact on you.
Version 1.7 — 8 October 2026: browser findings remain free. New report files are a separate purchase in the report portal. Existing promises of free files retain their original lifetime; earlier contract versions remain preserved.