Pentest sites you own. Only sites you own.
auto.hacker runs a non-destructive security scan against a website — missing headers, reflected-XSS markers, CORS and cookie flags, CSP, directory listing, error disclosure, sensitive paths, unsafe methods. It will not touch a host until you have proven you control it.
1 · Prove ownership
Add a hostname and publish one of three proofs: a DNS TXT record, a /.well-known file, or a <meta> tag. We check it live.
2 · Scan
Launch a scan. Ownership is re-checked at launch and again in the worker before a single request is sent. Findings stream in live.
3 · Watch it over time
Subscribe a verified host to weekly scans and get an emailed summary of new, fixed and open findings.
Honest about what this is: authorized testing of your own verified properties, with non-destructive checks only. The engine is ThreatCrush. This is not a substitute for a manual penetration test.