What is checked
Each scanner explains its requests and the limits of its conclusions. A measurement at a public address is not a comprehensive assessment of your organisation.
Choose a check and its scopeService status
Security and transparency
Understand what was checked.
Public measurements are useful when their scope remains clear. This page explains what the scanners do to a checked system, how this website is protected, and how to report a vulnerability.
Report a vulnerability Our scanner in your logs Protection of this website
How to read the result
Measured values, explanations, missing measurements and checks that do not apply remain distinct. The report documents the same scan state.
View a sample finding and its limitsUse and data
The binding information is in the terms of use and privacy notices. This overview does not replace contractual terms or processing information.
Read the terms of use Read the privacy policyErrors or unclear statements
If an observation or explanation does not match your environment, you can send a specific report. A good score is not a security guarantee.
Prepare a reportReport a vulnerability
If you find a vulnerability in this website, the scanners or a report, email security@wolf-agents.com in German or English. The same address is provided in machine-readable form in this website’s security.txt file.
Helpful details include:
- the affected address or function,
- the steps needed to reproduce the observation,
- the time and the observed effect.
Do not send access credentials or other people’s personal data. Go only as far as necessary to demonstrate the issue: do not access anyone else’s data, disrupt availability or deceive people.
Wolf-Agents is run by one person. We do not promise a response time, and there is no bounty programme. This page is neither an instruction nor permission to conduct tests beyond observing publicly accessible responses.
For questions unrelated to security, use the contact page. Full operator details are in the legal notice.
If our scanner has checked your system
The public checks are initiated when someone enters a target on this website. They confirm that they control the target or are authorised to check it, as required by the terms of use. Web Check requests use the User-Agent identifier WolfAgentsSecurityScanner and a link to this page; some additional requests use Wolf-Security-Scanner. The API Check and the Email Check’s MTA-STS policy request use WolfAgents-API-Security-Scanner. The Email Check’s SMTP probe introduces itself as wolf-scanner.com.
What the scanners do
- They request the entered address over HTTP or HTTPS and assess response headers, cookie attributes, TLS properties and technical features of the HTML. Redirects are checked again before each further request.
- They query the domain’s public DNS records.
- They request selected known standard paths, such as
/.well-known/security.txtor the MTA-STS policy. - During the Email Check, they connect to the domain’s mail servers, check whether STARTTLS is offered and close the connection. No email is handed over.
- During the API Check, they send several limited requests and an additional error probe to the specified endpoint.
What the scanners do not do
- No penetration testing or active attacks.
- No signing in or access to protected areas.
- No searching through directories or files, and no comprehensive crawling of the website.
The number of checks is limited per target domain and per requester. The scanners do not accept internal or private network addresses as targets. The result is stored with the technical data assessed for it, such as response headers. Section 4 of the privacy policy explains which data is retained and for how long. Each check’s page describes its exact scope.
If, as an operator, you want to understand or object to a check of your system, email info@wolf-agents.com with the time and target address. If you object to future checks, we will exclude the domain from public checks after verifying your authority (privacy policy, section 17).
How this website is protected
The following safeguards are implemented in this website’s versioned configuration and code. They describe the state as of 21 September 2026 and do not guarantee complete security.
Transport
- The website is accessible only over HTTPS; HTTP requests are redirected. TLS 1.2 and TLS 1.3 are permitted.
- HSTS is set with a two-year validity period, including subdomains. The domain is included in Chromium’s HSTS preload reference list.
Browser policies
- A Content Security Policy permits scripts only from this site and through fixed hashes. Third-party scripts, fonts and analytics services are not embedded; fonts are hosted on our own server.
- The pages may not be embedded in frames on other sites. Additional response headers restrict browser MIME type sniffing, disclosure of the referring address and other websites’ access to this site’s content (COOP, COEP, CORP).
- A Permissions Policy disables browser features this website does not need, such as the camera, microphone and location.
Application
- Forms, check requests and report downloads are rate limited. Our own computational challenge in the browser provides protection against automated submissions, without a third-party CAPTCHA service.
- The application rejects requests that a browser sends on behalf of another website.
- Entered targets are validated before each request. Internal and private network addresses are excluded, including after a redirect.
- Certain details, including the email address used for a result request, are stored in encrypted form. Section 19 of the privacy policy describes which fields this covers and the limits.
Publication
- Automated checks run before publication: a dependency check for known vulnerabilities, static code analysis with our own rules, type checking and tests.
- Publication requires the proprietor’s approval.
You can measure the externally visible part yourself: using the Web Security Check to check wolf-agents.com is expressly welcomed. A result describes the time of the measurement, not the security of the entire operation.
Operation and locations
The website, database and cache run on a rented Hetzner server in Nuremberg. The scanners run at Hetzner and netcup in Nuremberg. External backups are stored at Hetzner in Falkenstein. The proprietor operates the service himself; administrative access takes place from Germany.
Other service providers are involved, including for DNS and redirection, email delivery and the operator’s mailbox. Some routes involve countries outside the EU. The privacy policy provides the complete, binding details of providers, locations and these international connections: hosting, recipients and processors, international data transfers, and data security and backups.