What a Protectory scan does - and does not do

A scan is a passive, outside look at your public site: it runs 78 checks using the same requests a visitor's browser would make.

What it checks

• Files that should not be public (.env, .git, backups, source maps, directory listings).
• Secrets and keys inside the JavaScript your site sends to every visitor.
• Supabase and Firebase rules that let anyone read or write your data (read requests; a write test only when you opt in for your own project).
• HTTPS, certificates, security headers, cookies and the Content Security Policy.
• Known vulnerabilities in JavaScript libraries and WordPress components, and end-of-life server software.
• Email (SPF, DKIM, DMARC), domain expiry and blocklists.
• Basic SEO and speed signals.

What it does not do

• No penetration testing and no attack payloads.
• No logging in to your site or app.
• No changes to your site, data or settings.
• No running of your site's JavaScript to find versions.
• No more requests than your plan's crawl budget, paced politely.

Honest limits

• A passive scan sees only what is public; pages behind a login are not checked.
• Library detection depends on version strings reaching the browser: bundles without banners, renamed files and server-side packages are not detected.
• A known vulnerability in a version does not prove your site is exploitable.
• No scanner finds everything; Protectory does not claim complete coverage.